- Challenge
- A multi-vendor messaging stack produced duplicate OTPs on retry storms — a long-standing open bug.
- Approach
- A migration to the BroadNet REST API with one send path, retries only on network errors and 5xx, and every send tracked by the message ID the API returns — rolled out behind a single feature flag.
SMS API for critical messages, over REST or SMPP
An SMS API lets your software send text messages, such as one-time passcodes and alerts, with a single HTTP request: with BroadNet, your code calls POST /sms/sendSms with a Bearer token, or binds over SMPP for high-volume pipelines. Documented in an OpenAPI 3.1 spec. An official TypeScript SDK. Delivery reports by webhook. Test access on request.

What happens between
your POST and a delivery report.
One TLS handshake, five engineered hops, two webhooks. Every stage has its own latency budget — and every budget is on the SLA, not the marketing page.
- 01 · RequestYour app · REST
POST /sms/sendSms over TLS, Bearer-token auth, JSON body: senderId, destinationNumber, message, messageType.
p50 < 41ms TTFB - 02 · EdgeBroadNet API edge
Token check, schema validation and route lookup — the message ID comes straight back in the response.
p50 < 60ms - 03 · RouterRoute + queue
Per-route quality score selects fastest legal SMPP bind. Multi-region active-active failover in <800ms.
p50 < 10ms - 04 · BindOperator SMPP 3.4
Direct SMPP bind to the destination MNO. submit_sm sent; sequence number tracked for DLR correlation.
p50 < 1.5s - 05 · WebhookDelivery report
deliver_sm captured and POSTed to your webhook URL as a delivery report, keyed to the message ID.
p95 < 2s - ← delivery report · webhook
POST /sms/sendSms over TLS, Bearer-token auth, JSON body: senderId, destinationNumber, message, messageType.
Token check, schema validation and route lookup — the message ID comes straight back in the response.
Per-route quality score selects fastest legal SMPP bind. Multi-region active-active failover in <800ms.
Direct SMPP bind to the destination MNO. submit_sm sent; sequence number tracked for DLR correlation.
deliver_sm captured and POSTed to your webhook URL as a delivery report, keyed to the message ID.
Try the API
Fill in a request, hit send, and watch a simulated response and delivery flow — right here, no signup.
Authorization: Bearer $BROADNET_TOKENcurl -X POST https://api.broadnet.me/sms/sendSms \
-H "Authorization: Bearer $BROADNET_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"senderId": "BroadNet",
"destinationNumber": "447700900123",
"message": "Your verification code is 482913",
"messageType": "TEXT"
}'Fill in the request and hit Send test request to see an example response.
Runs entirely in your browser. No request leaves this page and no SMS is sent.
One call, nine ways to write it.
Every tab sends the same request: POST /sms/sendSms with a Bearer token and a JSON body of senderId, destinationNumber, message and messageType. The response body is the message ID.
BroadNet has one official SDK, for TypeScript and Node.js. The Node.js, Python, PHP, Java, C#, Go and Ruby tabs call the REST API directly with ordinary HTTP libraries, with no BroadNet package to install.
Full API referencecurl -X POST https://api.broadnet.me/sms/sendSms \ -H "Authorization: Bearer $BROADNET_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "senderId": "BroadNet", "destinationNumber": "447700900123", "message": "Your verification code is 482913", "messageType": "TEXT" }' # 200 OK → response body is the message ID, e.g. 2603121407537573731REST or SMPP — pick your protocol
Most teams ship on REST and never look back. High-volume carriers, aggregators, and legacy stacks bind to SMPP 3.4. Same routes, same SLA, same dashboard — choose the interface that matches the job.
- JSON over HTTPS, TLS 1.3
- Bearer-token auth — token from your BroadNet account
- POST /sms/sendSms · one path family per channel
- Immediate or scheduled send
- Delivery reports pushed to your webhook
- Full reference at /developers/api
- Binary SMPP v3.4 (v5.0 on request)
- Transmitter, Receiver, Transceiver binds
- Up to 32 concurrent binds per account
- DLR forwarding via deliver_sm
- TLS-wrapped binds, IP allow-list per credential
- Throughput up to 30,000 msg/sec per node on enterprise tier
Six things you stop having to build yourself.
Safe retries
Every accepted send returns a message ID. Retry on network errors and 5xx with backoff, and reconcile against delivery reports by message ID instead of blind re-sends — background workers can crash and recover cleanly.
Delivery webhooks
Delivery receipts are pushed to your webhook URL and tied to the message ID, for REST and SMPP traffic alike — no polling loop to write.
Concurrent connections
Up to 32 parallel SMPP binds per account. HTTP/2 multiplexing on REST. No fixed per-account rate limits — throughput is sized to your traffic, never capped per connection.
Auto-failover
Multi-region active-active. If a route degrades mid-campaign we re-bind in under 800ms and re-queue in-flight messages. No SMPP reconnect logic to write yourself.
No fixed rate limits
No fixed per-account rate limits — throughput is sized to your traffic, up to 30,000 SMS/s per node. No silent throttling, no shadow-banned numbers — you always know where you stand.
OpenAPI 3.1 spec
Machine-readable, served at /developers/openapi.yaml. The official TypeScript SDK is generated from it; generate a client in any other language, or import it into Postman or Insomnia.
What real engineering teams
say about the API.
- Challenge
- A large messaging engineering org kept losing time to undocumented API changes between releases.
- Approach
- The OpenAPI 3.1 spec is treated as the contract, with typed clients regenerated in CI on every release.
- Challenge
- The fraud team would not trust inbound delivery events it could not tie back to a send.
- Approach
- Every delivery report is matched to the message ID returned at send time, with sender-ID rotation absorbed inside the same flow.
The numbers we put in writing.
These targets are contractual on enterprise plans, not aspirational copy. Miss them and the credits below are automatic on the next invoice.
The receipts.
The official TypeScript SDK is generated from the public OpenAPI 3.1 spec, so the two never drift. Generate a client in any other language or import the spec into Postman. The docs run on the same staging environment your code does.
Engineering questions,
answered straight.
Request test access and we reply within one business day with your test credentials; your first test message reaches your own verified number about five minutes after that. Production traffic typically starts within 5–15 business days, gated by sender ID registration with the regulator — not by anything on our side.
Retry only on network errors and 5xx, with exponential backoff, and keep the message ID the API returns for every accepted send. Reconcile against delivery reports by message ID before re-sending, rather than blind retries, and top up credits before a low balance blocks traffic.
Real. The OpenAPI 3.1 spec at /developers/openapi.yaml (JSON at /developers/openapi.json) documents every channel — SMS, WhatsApp, RCS, Telegram, Push, Email, Messenger and Instagram. The official TypeScript SDK (@broadnet/cpaas-sdk) is generated from it, and you can generate your own client in any other language without asking us.
There is no API fee — you pay per message, per country, per route. UAE transactional starts at $0.0123/MT, KSA at $0.016 and Egypt at $0.028. SMPP binds are included on enterprise tier; on standard tier each dedicated bind is $250/month. Test access is on request, and test traffic is capped at 1,000 messages a day.
We retry with exponential backoff for 24 hours: 30s, 2m, 10m, 30m, 2h, 8h, 24h. Each retry includes an X-Webhook-Attempt header. After 24 hours the event is parked in the dead-letter queue, queryable and replayable from the dashboard with one click. Standard tier keeps DLQ for 7 days; enterprise for 90.
Yes — they share routing, DLRs, billing, and dashboards. Most customers use REST for transactional and SMPP for high-volume marketing on the same account, and delivery reports from both paths land in the same reports and webhooks.
Named technical account manager, 99.99% API uptime SLA with service credits against the monthly fee (10% below 99.99%, 25% below 99.0%, 50% below 95.0%), 24/7 NOC pager with <15-min sev-1 ack, dedicated SMPP binds, quarterly architecture reviews, and a shared Slack channel with the engineering team.
broadnet.me/status shows component status and any posted incidents. It is not yet fed by live monitoring, so its 90-day history is illustrative, not measured; the contractual figure is the 99.99% uptime SLA.
Question not here? Ask our engineering team
The SMS API is one entry point into the broader A2P SMS platform. The same direct operator routes also power bulk SMS campaigns, OTP and multi-channel verification, and the WhatsApp Business API.
Weighing providers? Read our Best SMS API in 2026 buyer's guide.

Delivered to 200+ countries, direct to the operator in 86.
No grey routes: a direct operator bind wherever one is commercially available, otherwise a labelled partner-managed route. One API to every channel, on a network built since 2003.
Stop wrestling your SMS provider.
Start shipping.
One access token, an official TypeScript SDK, and a quickstart that fits on a single screen. The fastest path from signup to your first delivery receipt.
Resources
SMS API datasheet
Related guides & answers
Go deeper on the concepts behind this product.