Mobipost: REST API Migration Guide
The Mobipost SOAP API (httpapi/messaging.asmx) is being switched off. To keep sending messages, you'll need to update your integration to use our REST API.
This guide only covers what changes. For full details on every endpoint and field, see the REST API documentation.
Before you start
- You need new API credentials. Your current Mobipost username and password will not work with the REST API.
- Your system must support TLS 1.2 at minimum. We recommend TLS 1.3. Older systems may fail to connect, usually with a generic connection or handshake error.
- Requests use JSON, not SOAP/XML. You send an HTTPS POST with a JSON body instead of a SOAP envelope.
Step 1: Create your REST API key
Everyone migrating must do this, even if you already have API credentials.
- Log in at https://app.sinch.com.
- Go to Settings → API Settings.
- In the Basic Authentication section, click Create new key.
- Copy your API key and API secret straight away and store them somewhere safe. The secret is only shown once, when the key is created. If you lose it, you'll need to create a new key.
Don't use the Create new key button under Legacy API Credentials. Those credentials only work with the old Mobipost API.
Send your key and secret in an HTTP Basic Authorization header on every request. The value is your key and secret joined by a colon, then Base64-encoded:
Authorization: Basic base64(API_KEY:API_SECRET)
Check it works: replace API_KEY and API_SECRET with your own, then run the request below. It only reads data, so no messages are sent.
curl https://au.app.api.sinch.com/v1/delivery_reports \ -u "API_KEY:API_SECRET" \ -H "Accept: application/json"
A 200 response means your key works (the list may be empty). A 401 means the key or secret is wrong.
Step 2: Update your API calls
What's different
| Mobipost API | REST API | |
|---|---|---|
| Address | https://www.mobipost.com.au/httpapi/messaging.asmx |
https://au.app.api.sinch.com/v1/messages |
| Request | SOAP envelope (XML) | POST with a JSON body |
| Credentials |
UserName and Password in the SOAP AuthenticationHeader
|
HTTP Basic Authorization header |
| Phone numbers |
61425253434 or 0425253434
|
E.164 international format, e.g. +61425253434
|
| Multiple recipients | Number list, CSV attachment or group | One message per recipient in the messages array, up to 100 per request |
| Response | Boolean, message ID and APIError
|
JSON, with a message_id (UUID) for each message |
Method by method
| Mobipost method | REST API |
|---|---|
QuickSMSSend, SendSMS
|
POST /v1/messages |
QuickMMSSend |
POST /v1/messages with "format": "MMS"
|
AddContent, GetContent, ListContent
|
Not needed. Link to your media with a public URL in each MMS |
GetSMS |
GET /v1/messages/{message_id} |
ValidateUser |
Not needed. Every request is checked, and a wrong key returns 401
|
The tables below only show the fields you need to change. For every field and its limits, see Send messages.
Sending an SMS (QuickSMSSend / SendSMS)
Before:
POST /httpapi/messaging.asmx
Content-Type: text/xml
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Header>
<AuthenticationHeader>
<UserName>USERNAME</UserName>
<Password>PASSWORD</Password>
</AuthenticationHeader>
</soap:Header>
<soap:Body>
<QuickSMSSend>
<oSMS>
<MessageText>Your appointment is on Monday at 9am</MessageText>
<Name>Appointment reminder</Name>
</oSMS>
<sContactNumbers>
<string>61425253434</string>
</sContactNumbers>
</QuickSMSSend>
</soap:Body>
</soap:Envelope>After:
POST https://au.app.api.sinch.com/v1/messages
Authorization: Basic <base64(API_KEY:API_SECRET)>
Content-Type: application/json
{
"messages": [
{
"content": "Your appointment is on Monday at 9am",
"destination_number": "+61425253434",
"metadata": { "name": "Appointment reminder" },
"delivery_report": true
}
]
}| Old field | New field |
|---|---|
UserName, Password
|
Authorization header |
sContactNumbers |
One message per recipient, with destination_number in E.164 format |
oContacts CSV or groupId (SendSMS) |
Build the messages list from your own recipient list, 100 at a time |
MessageText |
content. Long messages are split automatically |
MessageFrom |
source_number. Optional: leave it out to send from your account's default number |
Name |
metadata, e.g. {"name": "Appointment reminder"}. This is returned with your delivery reports and replies |
bSearchForCarrier |
Not needed |
Sending an MMS (QuickMMSSend)
Mobipost needed you to upload media with AddContent first, then send it by ContentID. With the REST API, you link to your media file in the message itself.
Before:
<QuickMMSSend>
<oMMS>
<ContentID>CONTENT_ID</ContentID>
<Subject>Spring sale</Subject>
<MessageHeader>Text above the image</MessageHeader>
<MessageFooter>Text below the image</MessageFooter>
<Name>Spring sale</Name>
</oMMS>
<sContactNumbers>
<string>61425253434</string>
</sContactNumbers>
</QuickMMSSend>After:
POST https://au.app.api.sinch.com/v1/messages
Authorization: Basic <base64(API_KEY:API_SECRET)>
Content-Type: application/json
{
"messages": [
{
"format": "MMS",
"subject": "Spring sale",
"content": "Text above the image. Text below the image.",
"media": ["https://www.example.com/spring-sale.jpg"],
"destination_number": "+61425253434",
"delivery_report": true
}
]
}| Old field | New field |
|---|---|
ContentID |
media: a list of public URLs to your files. Audio files (MP3, WAV) are not supported. See Send messages for supported file formats |
Subject |
subject (optional) |
MessageHeader, MessageFooter
|
Put this text in content
|
MMSFailoverMessage |
No equivalent. If you need a fallback SMS, watch for a failed delivery report and send an SMS yourself |
MessageFrom, Name
|
Same as SMS: source_number (optional) and metadata
|
Getting a sent message (GetSMS)
Before:
<GetSMS> <Id>SMS_ID</Id> </GetSMS>
After:
curl https://au.app.api.sinch.com/v1/messages/MESSAGE_ID \ -u "API_KEY:API_SECRET" \ -H "Accept: application/json"
Use the message_id returned when you sent the message. See Get message status for details.
Responses and errors
| Mobipost response | REST API response |
|---|---|
true with a message ID |
202, with a message_id for each message. Save this in place of the Mobipost message ID |
false with an APIError (invalid details) |
400 with a JSON error. The whole request is rejected, so check your numbers before sending. The error shows which message failed: for example, /messages/1/destination_number means the second message, because counting starts at 0 |
| Authentication failed | 401 |
For example error responses, see Send messages.
Step 3: Delivery reports and replies
Nothing changes with your webhooks. If you already have webhooks set up, you'll find them under Settings → API Settings → Webhooks and they'll keep working.
If you don't have any set up, we recommend creating a webhook there. Webhooks send delivery reports and replies to your system as they happen, and can be formatted to suit whatever your system expects. See Webhooks Management for the options.
To get delivery reports for messages sent through the REST API, add "delivery_report": true to each message.
You can also check for delivery reports and replies by calling the API, but webhooks are the recommended option.
Checklist
- New key created under Basic Authentication, and the secret saved
- System supports TLS 1.2 at minimum (TLS 1.3 recommended)
- SOAP calls replaced with JSON requests
- Phone numbers in E.164 format (
+61…) - Numbers checked before sending
- No more than 100 messages per request
- MMS media hosted at public URLs, in a supported image format
-
delivery_report: trueadded if you use delivery reports
Using an AI coding assistant
Our documentation has a version made for AI tools such as Claude, ChatGPT or Cursor. See AI Integration in the REST API documentation. You could start with a prompt like:
Update my code to stop using the Mobipost SOAP API (httpapi/messaging.asmx: QuickSMSSend, SendSMS, QuickMMSSend, GetSMS) and use the Sinch REST API instead (POST https://au.app.api.sinch.com/v1/messages, HTTP Basic authentication, JSON). Use the documentation at https://developers.app.sinch.com/llms.txt. Convert phone numbers to E.164 format, replace ContentID with a public media URL, move the message Name into metadata, and send no more than 100 messages per request.
FAQs
I already have Mobipost API credentials. Do I still need a new key?
Yes. Credentials listed under Legacy API Credentials only work with the old Mobipost API and will stop working when it's switched off.
Does the REST API support SOAP or XML?
No. All requests and responses are JSON.
What happens to my MMS content library?
The REST API doesn't use a content library. Host your images on your own website or file storage, and include the link in the media field of each MMS.
Can I still send audio in an MMS?
No. MP3 and WAV files are not supported.
How do I send to a group or a CSV of numbers?
Build the list of messages from your own recipient list, and send up to 100 messages per request.
My integration uses other Mobipost methods, such as contacts or templates.
These are no longer part of the Mobipost API. Contact support and we'll help you find the REST API equivalent.
More information
- REST API documentation
- Developer guides
- Old Mobipost docs: Mobipost Messaging API Specification, version 1.9 (December 2015)