# SMS API Documentation: REST & Webhooks | ZafeConnect

> Developer documentation for the ZafeConnect messaging API: send SMS, RCS, WhatsApp and email, track delivery, and receive signed webhooks.

Canonical URL: https://www.zafeconnect.com/developers
Language: en
Last modified: 2026-11-09

## ZafeConnect API documentation

URL: https://www.zafeconnect.com/developers

Developer documentation for the multi-channel messaging API: SMS, RCS, WhatsApp and email. Get an API key in your ZafeConnect account, send your first message in minutes, and follow delivery with webhooks.

- **Base URL:** https://api.zafeconnect.com. Every endpoint is prefixed with /v1.
- **Authentication:** Send your API key in the X-API-Key header on every request. Create and manage keys in your ZafeConnect account under API Keys. Keys come in live and test environments.
- **Format:** All requests and responses are JSON, UTF-8 encoded. Send Content-Type: application/json on requests with a body.
- **Charges:** Each message is charged in your account currency from your prepaid balance, or invoiced monthly for enterprise customers.

Limits: Send rate: 1,000 requests per minute per key; Bulk: Up to 10,000 messages per request, 100 requests per minute; Format: JSON, UTF-8; Authentication: X-API-Key header

### POST /v1/messages/send
Send a single message via SMS, RCS, WhatsApp or email.
- to (string, required): Recipient phone number (E.164) or email address
- channel (string, required): Primary channel: sms, rcs, whatsapp or email (or use channels[])
- channels (array): Channels in priority order; the first is primary, the rest are fallbacks
- message (string, required): Plain-text body. Used as-is on SMS; text fallback on HTML channels
- htmlmessage (string): HTML body (email only); ignored on SMS and WhatsApp
- sender (string): Sender ID. Must be an approved sender. The 11-character alphanumeric limit applies to SMS only
- subject (string): Email subject (email channel only)
- fallback (array): Backup channels tried if the primary fails, for example ["sms","email"]
- scheduled_at (ISO 8601): Send time. No offset means UTC. A trailing Z or an explicit offset both work

### POST /v1/messages/bulk
Send up to 10,000 messages in one request. Each is queued individually. Limited to 100 requests per minute.
- messages (array, required): Array of message objects with the same fields as /send (max 10,000)

### GET /v1/messages/:id
Get the current delivery status of a message by its ID.
- id (string, required): Message ID returned by /send or /bulk

### DELETE /v1/messages/:id
Cancel a scheduled message. Only works while the status is scheduled.
- id (string, required): Message ID of a scheduled message

### GET /v1/account/balance
Get your current account balance, currency and plan.


### GET /v1/account/pricing
Get your current prices per channel and country.
- channel (string): Filter: sms, rcs, whatsapp or email

### GET /v1/account/usage
Message volume and spend for a date range, broken down by channel.
- from (date): Start date, YYYY-MM-DD (default: 30 days ago)
- to (date): End date, YYYY-MM-DD (default: today)

### Webhooks
ZafeConnect sends a POST to your webhook URL when a message status changes. Set the URL in your API Keys settings. Each request carries three headers: X-ZafeConnect-Event, X-ZafeConnect-Timestamp and X-ZafeConnect-Signature. Return any 2xx status to acknowledge. ZafeConnect retries up to 5 times if your endpoint does not acknowledge. The signature is the hex HMAC-SHA256 of the string {timestamp}.{raw_request_body}, using your webhook signing secret. Compute it over the exact bytes received and compare it to the header.