Infobip

create_2fa_application

• ⚠Send the API key as 'Authorization: App <API_KEY>' — the prefix App; Bearer is only for OAuth 2.0 access tokens. Infobip API keys have a predefined expiry date and can be revoked at any time; a missing or invalid credential answers 401.
• ⚠The OpenAPI lists these API key scopes for this endpoint (x-scopes): 2fa:manage. Give the key a matching scope when you create it.
• ⚠Each Infobip account has its own base URL, xxxxx.api.infobip.com, shown once you log in to the Infobip API Resource hub. Set it in INFOBIP_BASE_URL (https://xxxxx.api.infobip.com in this spec is a placeholder). It identifies your account, the API key authenticates it.
• ⚠One-time setup: create the application once and store its applicationId; message templates and PIN sends reference it. The success status is 201.
• ⚠Configuration defaults in the OpenAPI: 3 PIN sends per phone number per day (sendPinPerPhoneNumberLimit 3/1d), 10000 per application per day (sendPinPerApplicationLimit 10000/1d), 1 verification per 3 seconds per number (verifyPinLimit 1/3s), PIN valid 15 minutes (pinTimeToLive 15m), 10 attempts (pinAttempts), and allowMultiplePinVerifications true.
• ⚠Limits use the format {attempts}/{timeLength}{timeUnit} and pinTimeToLive {timeLength}{timeUnit}, with timeUnit ms, s, m, h or d.
• ⚠Errors on this endpoint are { requestError: { serviceException: { messageId, text } } } — not the errorCode shape of the SMS v3 endpoints.
• ⚠A 429 means the endpoint's rate limit was hit; limits differ per endpoint. Retry with exponential backoff and honour the Retry-After header when present.

create_2fa_message_template

• ⚠Send the API key as 'Authorization: App <API_KEY>' — the prefix App; Bearer is only for OAuth 2.0 access tokens. Infobip API keys have a predefined expiry date and can be revoked at any time; a missing or invalid credential answers 401.
• ⚠The OpenAPI lists these API key scopes for this endpoint (x-scopes): 2fa:manage. Give the key a matching scope when you create it.
• ⚠Each Infobip account has its own base URL, xxxxx.api.infobip.com, shown once you log in to the Infobip API Resource hub. Set it in INFOBIP_BASE_URL (https://xxxxx.api.infobip.com in this spec is a placeholder). It identifies your account, the API key authenticates it.
• ⚠messageText must contain the {{pin}} placeholder; Infobip generates the PIN and inserts it there.
• ⚠One-time setup after create_2fa_application (appId = its applicationId). Store the returned messageId: send_2fa_pin_sms needs applicationId and messageId.
• ⚠senderId is the name that appears as the sender of the 2FA message.
• ⚠Errors on this endpoint are { requestError: { serviceException: { messageId, text } } } — not the errorCode shape of the SMS v3 endpoints.
• ⚠Not described here: regional.indiaDlt (in the request and the response). Infobip's OpenAPI: «Distributed Ledger Technology (DLT) specific parameters required for sending SMS to phone numbers registered in India.» That is outside this registry's African scope; see Infobip's API reference to send there.

get_sms_delivery_reports

• ⚠Send the API key as 'Authorization: App <API_KEY>' — the prefix App; Bearer is only for OAuth 2.0 access tokens. Infobip API keys have a predefined expiry date and can be revoked at any time; a missing or invalid credential answers 401.
• ⚠The OpenAPI lists these API key scopes for this endpoint (x-scopes): message:send, sms:message:send, sms:manage. Give the key a matching scope when you create it.
• ⚠Each Infobip account has its own base URL, xxxxx.api.infobip.com, shown once you log in to the Infobip API Resource hub. Set it in INFOBIP_BASE_URL (https://xxxxx.api.infobip.com in this spec is a placeholder). It identifies your account, the API key authenticates it.
• ⚠Each report is returned only once: store it as soon as you fetch it. If the status changes again later, a new report for the new status comes in a later call.
• ⚠Only the last 48 hours are available; limit defaults to 50 and caps at 1000 per call.
• ⚠This endpoint is the fallback for when you can't receive reports on a webhook (webhooks.delivery.url in send_sms).
• ⚠The OpenAPI documents no error body for this endpoint (401, 403, 500 have no schema): handle errors on the HTTP status. The 401 body shown on the authentication page is { requestError: { serviceException: { messageId, text } } }.

get_sms_logs

• ⚠Send the API key as 'Authorization: App <API_KEY>' — the prefix App; Bearer is only for OAuth 2.0 access tokens. Infobip API keys have a predefined expiry date and can be revoked at any time; a missing or invalid credential answers 401.
• ⚠The OpenAPI lists these API key scopes for this endpoint (x-scopes): sms:manage, sms:logs:read. Give the key a matching scope when you create it.
• ⚠Each Infobip account has its own base URL, xxxxx.api.infobip.com, shown once you log in to the Infobip API Resource hub. Set it in INFOBIP_BASE_URL (https://xxxxx.api.infobip.com in this spec is a placeholder). It identifies your account, the API key authenticates it.
• ⚠Logs cover the last 48 hours only, at most 1000 per call (limit defaults to 50). For more, enable useCursor and pass nextCursor back as cursor.
• ⚠To check whether a message was delivered, use delivery reports (webhook or get_sms_delivery_reports), not logs.
• ⚠bulkId, messageId and campaignReferenceId accept several values (2048 characters at most).
• ⚠List query parameters are declared style form, explode true in the OpenAPI (repeated keys: status=A&status=B, as this example sends them) while their descriptions say comma-separated values. With a single value both readings match.
• ⚠The OpenAPI documents no error body for this endpoint (401, 403, 429, 500 have no schema): handle errors on the HTTP status. The 401 body shown on the authentication page is { requestError: { serviceException: { messageId, text } } }.
• ⚠A 429 means the endpoint's rate limit was hit; limits differ per endpoint. Retry with exponential backoff and honour the Retry-After header when present.

list_whatsapp_templates

• ⚠Send the API key as 'Authorization: App <API_KEY>' — the prefix App; Bearer is only for OAuth 2.0 access tokens. Infobip API keys have a predefined expiry date and can be revoked at any time; a missing or invalid credential answers 401.
• ⚠The OpenAPI lists these API key scopes for this endpoint (x-scopes): whatsapp:manage. Give the key a matching scope when you create it.
• ⚠Each Infobip account has its own base URL, xxxxx.api.infobip.com, shown once you log in to the Infobip API Resource hub. Set it in INFOBIP_BASE_URL (https://xxxxx.api.infobip.com in this spec is a placeholder). It identifies your account, the API key authenticates it.
• ⚠Only templates pre-approved by WhatsApp can be sent: filter with status=APPROVED and reuse the exact name and language in send_whatsapp_template.
• ⚠Paginated: page starts at 0, size defaults to 10 and caps at 100; read paging.totalPages.
• ⚠List query parameters are declared style form, explode true in the OpenAPI (repeated keys: status=A&status=B, as this example sends them) while their descriptions say comma-separated values. With a single value both readings match.
• ⚠A 400 on this endpoint is { errorCode, description, action, violations[] (property + violation), resources[] }. Other statuses have no schema in the OpenAPI; the 401 body shown on the authentication page is { requestError: { serviceException: { messageId: 'UNAUTHORIZED', text } } } — handle both shapes.
• ⚠A 429 means the endpoint's rate limit was hit; limits differ per endpoint. Retry with exponential backoff and honour the Retry-After header when present.

resend_2fa_pin_sms

• ⚠Send the API key as 'Authorization: App <API_KEY>' — the prefix App; Bearer is only for OAuth 2.0 access tokens. Infobip API keys have a predefined expiry date and can be revoked at any time; a missing or invalid credential answers 401.
• ⚠The OpenAPI lists these API key scopes for this endpoint (x-scopes): 2fa:manage, 2fa:pin:send. Give the key a matching scope when you create it.
• ⚠Each Infobip account has its own base URL, xxxxx.api.infobip.com, shown once you log in to the Infobip API Resource hub. Set it in INFOBIP_BASE_URL (https://xxxxx.api.infobip.com in this spec is a placeholder). It identifies your account, the API key authenticates it.
• ⚠Resends the same PIN (not a new one); pinId is the value returned by send_2fa_pin_sms.
• ⚠Errors on this endpoint are { requestError: { serviceException: { messageId, text } } } — not the errorCode shape of the SMS v3 endpoints.

send_2fa_pin_sms

• ⚠Send the API key as 'Authorization: App <API_KEY>' — the prefix App; Bearer is only for OAuth 2.0 access tokens. Infobip API keys have a predefined expiry date and can be revoked at any time; a missing or invalid credential answers 401.
• ⚠The OpenAPI lists these API key scopes for this endpoint (x-scopes): 2fa:manage, 2fa:pin:send. Give the key a matching scope when you create it.
• ⚠Each Infobip account has its own base URL, xxxxx.api.infobip.com, shown once you log in to the Infobip API Resource hub. Set it in INFOBIP_BASE_URL (https://xxxxx.api.infobip.com in this spec is a placeholder). It identifies your account, the API key authenticates it.
• ⚠The response returns a pinId, not the PIN. Store the pinId: verify_2fa_pin and resend_2fa_pin_sms need it.
• ⚠Check smsStatus in the response (MESSAGE_SENT or MESSAGE_NOT_SENT).
• ⚠Needs an existing 2FA application and message template (applicationId + messageId), created once beforehand.
• ⚠ncNeeded defaults to true: a Number Lookup runs before every send unless you pass ncNeeded=false, and ncStatus reports it. The SMS is not sent when the destination is unreachable — the doc names that status NC_NOT_REACHABLE, while its list of values says NC_DESTINATION_NOT_REACHABLE; check both.
• ⚠Errors on this endpoint are { requestError: { serviceException: { messageId, text } } } — not the errorCode shape of the SMS v3 endpoints.

send_sms

• ⚠Send the API key as 'Authorization: App <API_KEY>' — the prefix App; Bearer is only for OAuth 2.0 access tokens. Infobip API keys have a predefined expiry date and can be revoked at any time; a missing or invalid credential answers 401.
• ⚠The OpenAPI lists these API key scopes for this endpoint (x-scopes): message:send, sms:message:send, sms:manage. Give the key a matching scope when you create it.
• ⚠Each Infobip account has its own base URL, xxxxx.api.infobip.com, shown once you log in to the Infobip API Resource hub. Set it in INFOBIP_BASE_URL (https://xxxxx.api.infobip.com in this spec is a placeholder). It identifies your account, the API key authenticates it.
• ⚠Free trial accounts: the default test sender is ServiceSMS and messages only go to the phone numbers verified at signup (up to 5), within the trial's free credits. Self sign-up accounts cannot send SMS to South Sudan.
• ⚠A 200 only means the request was accepted: each message comes back with a status (groupName PENDING, ACCEPTED, ...). The final state arrives as a delivery report — webhook (webhooks.delivery.url, or your Subscription settings when no URL is given) or get_sms_delivery_reports.
• ⚠If your delivery report URL is down, Infobip retries on the cycle 1min + (1min * retryNumber * retryNumber).
• ⚠options.schedule.sendAt schedules the send (format yyyy-MM-dd'T'HH:mm:ss.SSSZ), at most 180 days ahead; keep the bulkId to follow the batch.
• ⚠Sender rules are per country: an alphanumeric sender is 3-11 characters and can't receive replies. 44 of the 54 African country cards require registering the sender for local traffic and 27 also for international traffic (Nigeria: local '+20' days with documents such as the CAC certificate, international 6 days), and South Africa doesn't support alphanumeric senders at all. Check the country card on Infobip's SMS coverage page before going live.
• ⚠Infobip's coverage page has a card for every African country, but says it "covers general market and service provisioning details for the most frequently requested countries and does not reflect full Infobip coverage": for account-specific coverage, contact your account manager or Support. Some cards set allowed send time windows (e.g. Botswana: never on Sunday).
• ⚠A 400 on this endpoint is { errorCode, description, action, violations[] (property + violation), resources[] }. Other statuses have no schema in the OpenAPI; the 401 body shown on the authentication page is { requestError: { serviceException: { messageId: 'UNAUTHORIZED', text } } } — handle both shapes.
• ⚠Not described here: options.regional (indiaDlt, turkeyIys, southKorea). Infobip's OpenAPI: «Region-specific parameters, often imposed by local laws. Use this, if country or region that you are sending an SMS to requires additional information.» Its three entries are for numbers registered in India, Turkey and South Korea, outside this registry's African scope; see Infobip's API reference to send there.

send_whatsapp_template

• ⚠Send the API key as 'Authorization: App <API_KEY>' — the prefix App; Bearer is only for OAuth 2.0 access tokens. Infobip API keys have a predefined expiry date and can be revoked at any time; a missing or invalid credential answers 401.
• ⚠The OpenAPI lists these API key scopes for this endpoint (x-scopes): message:send, whatsapp:message:send, whatsapp:manage. Give the key a matching scope when you create it.
• ⚠Each Infobip account has its own base URL, xxxxx.api.infobip.com, shown once you log in to the Infobip API Resource hub. Set it in INFOBIP_BASE_URL (https://xxxxx.api.infobip.com in this spec is a placeholder). It identifies your account, the API key authenticates it.
• ⚠Templates can be sent at any time, outside the 24-hour window, but each one must be registered and pre-approved by WhatsApp first: check it with list_whatsapp_templates (status APPROVED, exact name and language).
• ⚠The body is a bulk envelope: messages[] can hold several recipients, sent under one bulkId; the response lists one status per message.
• ⚠The response doesn't contain the final delivery status: delivery (and seen) reports go to notifyUrl per message, or to an account-level URL set up by Infobip support.
• ⚠Errors on this endpoint are { requestError: { serviceException: { messageId, text, validationErrors } } } — not the errorCode shape of the SMS v3 endpoints.
• ⚠A 429 means the endpoint's rate limit was hit; limits differ per endpoint. Retry with exponential backoff and honour the Retry-After header when present.
• ⚠Not described here: ORDER_DETAILS buttons and templateData.orderStatus (WhatsApp order and payment templates). Infobip's OpenAPI allows them only with orderCurrency INR or BRL (OrderCurrency «enum: [INR, BRL]», required) and Indian or Brazilian payment types (UPI_INTENT, UPI_LINK, PG_PAYU, PG_RAZORPAY, BRAZIL_PIX_DC, BRAZIL_LINK, BRAZIL_BOLETO, BRAZIL_PAYMENTS), outside this registry's African scope. templateData does not reject them: see Infobip's API reference if you need one.

send_whatsapp_text

• ⚠Send the API key as 'Authorization: App <API_KEY>' — the prefix App; Bearer is only for OAuth 2.0 access tokens. Infobip API keys have a predefined expiry date and can be revoked at any time; a missing or invalid credential answers 401.
• ⚠The OpenAPI lists these API key scopes for this endpoint (x-scopes): message:send, whatsapp:message:send, whatsapp:manage. Give the key a matching scope when you create it.
• ⚠Each Infobip account has its own base URL, xxxxx.api.infobip.com, shown once you log in to the Infobip API Resource hub. Set it in INFOBIP_BASE_URL (https://xxxxx.api.infobip.com in this spec is a placeholder). It identifies your account, the API key authenticates it.
• ⚠A text message is only delivered if the recipient contacted the business within the last 24 hours; otherwise send a template (send_whatsapp_template).
• ⚠from is your registered WhatsApp sender number in international format; to is the recipient's number in international format (or a WhatsApp business-scoped user ID).
• ⚠The response doesn't contain the final delivery status: delivery (and seen) reports go to notifyUrl per message, or to an account-level URL set up by Infobip support.
• ⚠Errors on this endpoint are { requestError: { serviceException: { messageId, text, validationErrors } } } — not the errorCode shape of the SMS v3 endpoints.
• ⚠A 429 means the endpoint's rate limit was hit; limits differ per endpoint. Retry with exponential backoff and honour the Retry-After header when present.

verify_2fa_pin

• ⚠Send the API key as 'Authorization: App <API_KEY>' — the prefix App; Bearer is only for OAuth 2.0 access tokens. Infobip API keys have a predefined expiry date and can be revoked at any time; a missing or invalid credential answers 401.
• ⚠The OpenAPI lists these API key scopes for this endpoint (x-scopes): 2fa:manage, 2fa:pin:send. Give the key a matching scope when you create it.
• ⚠Each Infobip account has its own base URL, xxxxx.api.infobip.com, shown once you log in to the Infobip API Resource hub. Set it in INFOBIP_BASE_URL (https://xxxxx.api.infobip.com in this spec is a placeholder). It identifies your account, the API key authenticates it.
• ⚠Decide on the verified field, not on the HTTP status: the response also carries attemptsRemaining and pinError.
• ⚠Attempts and verification frequency are capped by the 2FA application (pinAttempts, verifyPinLimit — 1 per 3 seconds by default). allowMultiplePinVerifications defaults to true: set it to false if a PIN must not verify twice.
• ⚠Errors on this endpoint are { requestError: { serviceException: { messageId, text } } } — not the errorCode shape of the SMS v3 endpoints.

webhook_sms_delivery_report

• ⚠Set the URL per message with webhooks.delivery.url in send_sms, or once in Subscriptions management.
• ⚠One call carries up to 100 reports by default (maxBucketSize in the Subscriptions API changes it): process every entry of results[].
• ⚠Return 200 to accept the callback. If your URL becomes unavailable, Infobip retries on the cycle 1min + (1min * retryNumber * retryNumber).
• ⚠Infobip can authenticate the calls it makes to your webhook (security settings of type BASIC, HMAC, OAUTH or CUSTOM, created with POST /subscriptions/1/security), but the OpenAPI doesn't describe the header or signature it then sends — this spec has no verification step, and the docs don't say whether those settings apply to a per-message URL. Treat the payload as untrusted until confirmed (for SMS, the message status is in get_sms_logs).

webhook_whatsapp_delivery_report

• ⚠Set the URL per message with notifyUrl, or ask Infobip support to set an account-level URL. One URL receives all report types (delivery and seen reports), so check the payload shape.
• ⚠Infobip can authenticate the calls it makes to your webhook (security settings of type BASIC, HMAC, OAUTH or CUSTOM, created with POST /subscriptions/1/security), but the OpenAPI doesn't describe the header or signature it then sends — this spec has no verification step, and the docs don't say whether those settings apply to a per-message URL. Treat the payload as untrusted: the OpenAPI has no WhatsApp report or log endpoint to cross-check it.