Sandbox accounts for API development

A sandbox lets you build and test an API integration against the real Mobile Message API without any live sending.

Creating your sandbox

1. Log in and go to Settings > API.
2. Click Create sandbox. You're switched into it straight away.
3. Create an API key and set your webhook URLs on the same page, the same way as on your live account.

To move between the two, open the menu under your name and choose Switch to sandbox or Back to live account. While you're in the sandbox a banner at the top of every page says so. Anyone on your account who can manage API settings can create and use the sandbox.

Your sandbox comes with test credits and sends from the sandbox number 0491 570 006 (61491570006), a number reserved for fiction that never belongs to a real phone. Any Australian mobile number can be used as a recipient, because nothing is delivered.

If you don't have a Mobile Message account, for example because you're reviewing an integration, email hello@mobilemessage.com.au and we'll set up a test account for you.

How a sandbox behaves

A sandbox works exactly like a live account at the API level, with sending disconnected:

• Requests are validated and answered exactly as on a live account. You receive real message_id values, per-message results, and cost calculations in responses.
• No messages are ever delivered to handsets, and no credits are consumed.
• Accepted messages are recorded with a final status, so message lookup flows can be exercised end to end. Scheduled messages are released at their scheduled time.
• Contacts, lists, unsubscribes, idempotency keys and the other account endpoints behave exactly as live.

This makes a sandbox safe for CI. Your integration tests can run against the real API with no risk of live SMS traffic or charges.

Delivery receipt webhooks

Delivery receipt webhooks fire for test sends. Around 5 seconds after a message is accepted, a simulated delivery receipt is posted to your status webhook URL with the same payload as a real one, one webhook per message part. Set up your webhook URLs the normal way, see Setting up webhooks. If your account has a signing secret, simulated webhooks are signed exactly like real ones.

To test your failure handling, send to any number ending in 000 (for example 0412345000). That message is recorded as failed and its delivery receipt reports failed. All other test messages are reported as delivered.

Simulating inbound messages

Sandboxes can simulate a reply with POST /v1/test-inbound. This records the inbound message on your account exactly as a real reply would, including opt-out processing when the message starts with STOP, and posts to your inbound webhook URL if one is set.

curl -u user123:mypassword \
  -H "Content-Type: application/json" \
  -d '{"from": "0412345678", "message": "Thanks, see you then!"}' \
  https://api.mobilemessage.com.au/v1/test-inbound

Response:

{ "status": "success", "type": "inbound", "to": "YourBrand", "from": "61412345678", "webhook_queued": true }

type is unsubscribe when the message was treated as an opt-out. The inbound webhook payload is identical to a real inbound message, including original_message_id and original_custom_ref when the reply matches a message you previously sent to that number.

The endpoint returns 403 on live accounts and allows up to 100 simulated inbound messages per hour.

Good to know

• A sandbox can send up to 10,000 messages a day, resetting at midnight UTC. Requests over the limit return 429.
• Short links in sandbox messages open a test page instead of the destination website. Clicks are still recorded, so link tracking can be tested.
• A real dedicated number can't be attached to a sandbox, because nothing reaches the carrier network. Two-way flows are still fully testable with the simulated inbound endpoint above.
• ACMA sender ID registration is not available in a sandbox. Registrations are lodged with the real ACMA register, so they can only be submitted from a live account.
• The webhooks page in your dashboard shows the delivery log for simulated webhooks the same way it does for real ones, see Webhook delivery logs.
• The full API reference, including the test account section, is at mobilemessage.com.au/api-documentation.