Skip to content
Wire2AirWire2Air
Wire2AirWire2Air
Log inBook a demoFree trial

Loading the index…

Webhooks

How Wire2Air calls your server when a message arrives or a delivery report comes in, and how to build a receiver that is safe to expose.

Last updated

A webhook is a URL on your server that Wire2Air calls. Wire2Air sends three kinds:

WebhookWhenPage
Inbound SMSSomeone texts your short codeInbound SMS
Inbound SMS and MMSSomeone sends a message, including picture messages, to your short codeInbound SMS and MMS
Delivery reportA sent message's status changesDelivery reports

All three are plain HTTP GET requests with the data in the query string.

Registering your URL

The documentation names three places a callback URL is set:

  • ProcessorURL on a Developer API campaign or a registered keyword: where that keyword's incoming messages go.
  • Replypath (REST) or ReplyPath (HTTP API) on a send request: where replies to that message go. The HTTP API docs say this is available "case by case", with the advanced developer API only.
  • Delivery reports need an Advanced Developer API account, according to the HTTP API send page.

Build a safe receiver

Until those answers are published, build every receiver like this:

  • Answer quickly with 200. Store the request and process it afterwards, so a slow database does not cause a timeout.
  • Expect duplicates. Make processing idempotent, for example by remembering the message ID or the smsoutboxid you have already handled.
  • Validate every value. Treat each parameter as untrusted input; never put it into SQL or HTML unescaped.
  • Use a URL that is hard to guess, for example one with a long random path segment, and change it if it leaks. Because requests are not signed, the URL is the only secret.
  • Prefer an https:// URL if your account accepts one, so message content is encrypted on the way to you.