The SMS API for global A2P messaging

An SMS API lets your software send and receive text messages over HTTP instead of through a phone. Your application calls the API with a recipient, sender and message body; the provider routes the message to mobile carriers and reports delivery back to you through webhooks. CommLeap's SMS API uses the same endpoint and event model as our WhatsApp and email channels, and RCS Business Messaging (coming soon) will use it too.

P2P (person-to-person) SMS is traffic between individuals. A2P (application-to-person) SMS is sent by a business system — alerts, one-time passcodes, reminders and campaigns. Carriers treat A2P traffic differently, often requiring registered senders and dedicated routes, so business messaging should always be sent as A2P.

It depends on the country and sender type. In the US, A2P traffic on local numbers requires 10DLC brand and campaign registration through The Campaign Registry, toll-free numbers must be verified before sending, and short codes go through a carrier approval process. Many other countries require alphanumeric sender IDs to be pre-registered. CommLeap helps you identify what applies to each destination and prepares the submissions with you.

Messages using the standard GSM-7 character set fit 160 characters in a single segment, or 153 per segment when concatenated. Messages that contain emoji or characters outside GSM-7 are sent as Unicode (UCS-2), which fits 70 characters in one segment or 67 per segment when concatenated. Each segment is billed, so the CommLeap API returns the encoding and segment count for every message.

Standard opt-out keywords such as STOP, END, CANCEL, UNSUBSCRIBE and QUIT are recognized automatically: the number is added to your suppression list, a single confirmation can be sent, and future messages to that recipient are blocked until they opt back in. HELP replies return your configured support message. You can add custom keywords and localized equivalents for other markets. Customers may also opt out in their own words or through other channels — in the US, FCC rules require honoring any reasonable opt-out request within 10 business days — so you remain responsible for recording and honoring those requests too.

SMS pumping, also called artificially inflated traffic, happens when fraudsters trigger large volumes of messages — usually one-time passcodes — to number ranges that earn them revenue. CommLeap's dedicated fraud controls are coming soon: they will be designed to limit exposure with country allowlists, velocity limits by number and prefix, anomaly alerts and spend controls. Pairing SMS with our Verify API adds conversion tracking for OTP flows.

Automatic SMS fallback is coming soon. Once it launches, you will be able to add a fallback list to a WhatsApp message — or an RCS message, when RCS Business Messaging (also coming soon) is available — and CommLeap will send an SMS if the richer message cannot be delivered, or is not delivered within the time you set. One request, one webhook stream and one report will cover every attempt.

SMS is priced per segment, and rates depend on the destination country and, in some markets, on the carrier and sender type. Registration and number fees may also apply. Request a quote for your destinations.

Yes. Canada's Anti-Spam Legislation (CASL) applies to commercial electronic messages, including SMS, sent to or from Canada. In general you need the recipient's express or implied consent, each message must identify the sender and include contact information, and it must offer an unsubscribe mechanism that is honored within 10 business days. CommLeap provides consent records, opt-out handling and quiet hours to support these practices; you remain responsible for your consent and message content. See the CRTC's CASL guidance.