Overview
This is the entry point for the SMSTAKE messaging APIs on https://api.smstake.com. RCS, Voice and WhatsApp Business use HTTPS JSON under https://api.smstake.com/v1/. SMS uses HTTP GET, XML and JSON on its own paths, with a username and password. Credentials are issued after onboarding.
Quick start
For RCS, Voice and WhatsApp, send a Bearer token on every request. Use HTTPS only, and keep the token in an environment variable.
Authorization: Bearer YOUR_API_TOKEN
Content-Type: application/jsonBase URL: https://api.smstake.com/v1/. Channel paths continue from there.
| Channel | Authentication | Base URL |
|---|---|---|
| RCS | Bearer token | https://api.smstake.com/v1/rcs/ |
| Voice | Bearer token, or X-API-Key. Send one, not both | https://api.smstake.com/v1/voice/ |
| Bearer token | https://api.smstake.com/v1/whatsapp/ | |
| SMS | username and password | https://api.smstake.com/smsapi/httpapi.jsp |
curl -X POST "https://api.smstake.com/v1/rcs/send" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d @payload.jsonReplace the path with the channel you are calling. SMS does not use this header. Its parameters are on the SMS API page.
Channels
Open a reference for request fields, sample code in cURL, Python and Node.js, and the webhook events for that channel.
SMS
Transactional and promotional SMS with a DLT sender ID, Principal Entity ID and template ID. Pull a delivery report, or receive one on a webhook.
SMS API referenceRCS
Single and batch sends, rich cards, carousels and suggested actions. Delivery and read events come back on a webhook.
RCS API referenceVoice
Outbound calls, voice OTP and IVR. Play a recorded file or text-to-speech, and receive call status and keypad events.
Voice API referenceWhatsApp Business API
Utility, authentication and marketing templates, plus session images, documents, reply buttons and call-to-action URLs.
WhatsApp API referenceStatus and limits
Request throttling
RCS, Voice and WhatsApp calls that go over the account limit return 429. Wait, then retry with backoff. The limit is set on the account at onboarding. SMS rejections use the error codes on the SMS API page.
HTTP status
These codes apply to the https://api.smstake.com/v1/ channels. A channel page notes when a code means something more specific.
| HTTP status | Meaning |
|---|---|
| 200 | Request succeeded. A send may instead return 202 when it is accepted for processing |
| 400 | Invalid JSON, or a required field is missing |
| 401 | Missing or invalid Bearer token or API key |
| 429 | Rate limit exceeded. Retry with backoff |
| 500 | Temporary server error. Other 5xx responses mean the same. Retry with backoff |
Webhook security
Register an HTTPS URL on the SMSTAKE account. Return 200 OK as soon as the event is stored. When signing is enabled, verify X-SMSTAKE-Signature against the raw body before you trust the payload. The value is sha256= plus the hex HMAC-SHA256 of those exact bytes. Deduplicate on the event id plus event. Receiver patterns are in the DLR webhook integration guide.
X-SMSTAKE-Signature: sha256=<hex-encoded HMAC-SHA256 of the raw body>