> ## Documentation Index > Fetch the complete documentation index at: https://docs.spenza.com/llms.txt > Use this file to discover all available pages before exploring further. # Send an SMS > Send a Mobile-Originated (MO) SMS from a number provisioned on your account. Requires the account's `Admin` role tier. **MO SMS is only implemented for some operators** (SpenzaJ today) — everyone else gets `501`. This is a synchronous endpoint that returns `201` directly (NestJS's default for `@Post()`, since the handler has no `@HttpCode` override); it does not follow the async `202` + transaction-polling pattern used elsewhere. `fromNumber`, `toNumber`, and `text` are all shown as `required` below to reflect this endpoint's actual runtime behavior — enforcement happens in controller logic, not in the underlying DTO. `toNumber` is only validated for E.164 format; it is not checked against any ownership/allow-list. ## OpenAPI ````yaml /openapi.yaml post /api/v1.1/sms openapi: 3.1.0 info: title: Spenza Partner API version: 3.0.0 summary: >- Partner API for SIMs, eSIMs, plans, billing, users, groups and numbers — v1.1 surface. description: > The **Spenza Partner API** lets you manage SIMs, eSIMs, plans, subscriptions, billing, users, phone numbers, teams and device/SIM/user groups programmatically. All endpoints follow one consistent standard: - **Auth** — exchange your API `key` + `secret` for a bearer token, then send `Authorization: Bearer ` on every request. - **Envelopes** — success responses are `{ success, data, meta? }`; errors are `{ success: false, error: { code, message, details? } }`. - **Pagination** — list endpoints accept `page` (1-indexed) and `pageSize` (max 100); totals are returned in `meta`. - **Idempotency** — many write endpoints honor an optional `Idempotency-Key` request header so a retried call replays the original result instead of repeating the side effect. - **Async operations** — a handful of endpoints (eSIM provisioning, port-in, the `/api/v3/...` purchase variants, top-up) return `202` (`201` for top-up) with a `transactionId` + `statusEndpoint` instead of the finished resource. Poll `GET /api/v3/transactions/{transactionId}` (no auth required) until the transaction reaches a terminal status. One resource — **port-in submission** — is a documented exception: it lives at `POST /api/v3/port-in`, requires an Admin-tier account role rather than just a valid bearer token, and is **not** on the standard envelope (see that operation's description for its exact response shape). contact: name: Spenza API Support email: support@spenza.com url: https://spenza.com license: name: Proprietary url: https://spenza.com/terms x-logo: url: https://spenza.com/logo.png altText: Spenza servers: - url: https://api.spenza.com description: Production security: - bearerAuth: [] tags: - name: Authentication description: Exchange API credentials for a bearer token. - name: SIMs description: List, inspect, assign and manage SIMs. - name: Subscriptions description: Plan subscriptions attached to SIMs. - name: Plans & Catalog description: Purchasable plans and SIM products. - name: eSIM description: Provision eSIMs and fetch activation QR / install status. - name: Billing description: Invoices, credit balance and top-ups. - name: Users description: End users (employees) on your account that SIMs/devices are assigned to. - name: Orders & Transactions description: Order history and financial transactions. - name: Numbers & Port-in description: Check port-in eligibility and port existing numbers into Spenza. - name: Messaging description: Send outbound SMS from a provisioned number. - name: Webhooks description: Register endpoints for operator SMS/voice events and inspect deliveries. - name: Notifications description: In-account notifications and delivery preferences. - name: Device Groups description: Organize devices into named groups with spend/data limits. - name: SIM Groups description: Organize SIMs into named groups with spend/data limits. - name: User Groups description: Organize users (departments) into named groups with spend/data limits. - name: Devices description: The device catalog (phones/tablets) and their assignment to users. - name: Team Members description: Admins who manage your Spenza account (distinct from Users/end-users). - name: Async Status description: Universal status poll for any asynchronous (v3) operation. paths: /api/v1.1/sms: post: tags: - Messaging summary: Send an SMS description: | Send a Mobile-Originated (MO) SMS from a number provisioned on your account. Requires the account's `Admin` role tier. **MO SMS is only implemented for some operators** (SpenzaJ today) — everyone else gets `501`. This is a synchronous endpoint that returns `201` directly (NestJS's default for `@Post()`, since the handler has no `@HttpCode` override); it does not follow the async `202` + transaction-polling pattern used elsewhere. `fromNumber`, `toNumber`, and `text` are all shown as `required` below to reflect this endpoint's actual runtime behavior — enforcement happens in controller logic, not in the underlying DTO. `toNumber` is only validated for E.164 format; it is not checked against any ownership/allow-list. operationId: sendSms parameters: - $ref: '#/components/parameters/IdempotencyKey' requestBody: required: true content: application/json: schema: type: object required: - fromNumber - toNumber - text properties: fromNumber: type: string description: A provisioned number in your inventory, E.164. example: '+12792044584' toNumber: type: string description: E.164. example: '+15555551234' text: type: string example: Hello from Spenza! responses: '201': description: Sent. content: application/json: example: success: true data: message: Outbound SMS sent successfully '400': description: Missing fields, or a number not in E.164 format. content: application/json: examples: missing: value: success: false error: code: MISSING_FIELDS message: Please provide the sender number recipient number: null and message text.: null format: value: success: false error: code: VALIDATION_ERROR message: >- fromNumber must be a phone number in E.164 format, for example +15555550100. '403': description: Your token's account role isn't `Admin`. content: application/json: example: success: false error: code: FORBIDDEN message: Sending SMS requires the account's Admin role. '404': description: fromNumber isn't a provisioned number on your account. content: application/json: example: success: false error: code: SIM_NOT_FOUND message: That phone number isn't part of your provisioned numbers. '409': description: >- The `Idempotency-Key` was reused with a different request, or a replay was attempted while the original request was still in flight. content: application/json: examples: idempotencyKeyReused: value: success: false error: code: IDEMPOTENCY_KEY_REUSED message: >- This request was already submitted with different details — please use a new idempotency key. conflict: value: success: false error: code: CONFLICT message: >- A request with this idempotency key is already in progress. '429': $ref: '#/components/responses/RateLimited' '500': description: >- The operator service couldn't be resolved, or the downstream send failed. content: application/json: example: success: false error: code: INTERNAL_ERROR message: The message could not be sent. Please try again later. '501': description: This carrier doesn't support outbound SMS. content: application/json: example: success: false error: code: NOT_IMPLEMENTED message: Sending text messages isn't supported for this carrier yet. security: - bearerAuth: [] components: parameters: IdempotencyKey: name: Idempotency-Key in: header required: false description: > Any string unique to this logical request. On a retry with the same key and the same request body, the original response is replayed verbatim (with an `Idempotency-Replayed: true` response header) instead of the action repeating. Reusing the key with a **different** body or on a different route returns `409 IDEMPOTENCY_KEY_REUSED`. A replay attempted while the original call is still in flight returns `409 CONFLICT`. Optional — omit it and the endpoint behaves exactly as it would otherwise. schema: type: string example: a1b2c3d4-idem-key-001 responses: RateLimited: description: > Rate limit exceeded for this endpoint (or the account-wide default of 120 req/min). Only `Retry-After` is present on this response — the `X-RateLimit-*` headers below are sent on successful (non-429) requests, not on the 429 itself. headers: Retry-After: description: Seconds until you can retry. schema: type: integer content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' example: success: false error: code: RATE_LIMITED message: 'ThrottlerException: Too Many Requests' schemas: ErrorEnvelope: type: object required: - success - error properties: success: type: boolean example: false error: type: object required: - code - message properties: code: type: string example: SIM_NOT_FOUND message: type: string example: We couldn't find a SIM with that ICCID on your account. details: description: >- Present on some 4xx errors (for example a list of missing fields). Always absent on 5xx. type: object securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: Bearer token obtained from `POST /api/v1.1/auth/token`. ````