A Twilio mock API with delivery receipts and signed callbacks

Connect

Import it. In Sonda: Import → From a URL, paste the OpenAPI address. You get a folder per resource and a request per operation, with example bodies and ids from the seed account, so each request works as it is. Then set the auth: Basic auth, user AC0123456789abcdef0123456789abcdef, any password (it signs your callbacks). Any client that imports OpenAPI 3 takes the same address.

Twilio’s SDKs know nothing about sondahub’s sessions, so give them the few lines that carry X-Sondahub-Session — otherwise each call starts from the seed account.

Python (twilio-python)

from twilio.rest import Client
from twilio.http.http_client import TwilioHttpClient

# carry the sandbox session from each answer to the next request
http = TwilioHttpClient()
def keep(r, *args, **kwargs):
    if 'X-Sondahub-Session' in r.headers:
        http.session.headers['X-Sondahub-Session'] = r.headers['X-Sondahub-Session']
http.session.hooks['response'].append(keep)

client = Client('AC0123456789abcdef0123456789abcdef', 'sandbox_auth_token', http_client=http)
client.api.base_url = 'https://api.sondahub.com'
client.verify.base_url = 'https://api.sondahub.com/verify'
client.lookups.base_url = 'https://api.sondahub.com/lookups'

msg = client.messages.create(to='+14155550100', from_='+15005550006', body='Hi', status_callback='https://your-app.example/twilio/status')

Node (twilio)

import twilio from 'twilio'

const client = twilio('AC0123456789abcdef0123456789abcdef', 'sandbox_auth_token')
client.api.baseUrl = 'https://api.sondahub.com'
client.verify.baseUrl = 'https://api.sondahub.com/verify'
client.lookups.baseUrl = 'https://api.sondahub.com/lookups'

// carry the sandbox session from each answer to the next request
let session = null
client.httpClient.axios.interceptors.request.use((config) => {
  if (session) config.headers['X-Sondahub-Session'] = session
  return config
})
client.httpClient.axios.interceptors.response.use((response) => {
  session = response.headers['x-sondahub-session'] ?? session
  return response
})

Try it here

curl -X POST https://api.sondahub.com/2010-04-01/Accounts/AC0123456789abcdef0123456789abcdef/Messages.json \
  -u AC0123456789abcdef0123456789abcdef:sandbox_auth_token \
  --data-urlencode "To=+14155550100" \
  --data-urlencode "From=+15005550006" \
  --data-urlencode "Body=Hello from the sandbox"

curl https://api.sondahub.com/2010-04-01/Accounts/AC0123456789abcdef0123456789abcdef/Messages/SMb337ff2db88ca176ca5a3e57a1e2c7c1.json \
  -u AC0123456789abcdef0123456789abcdef:sandbox_auth_token -H "X-Sondahub-Session: $TOKEN"

curl -X POST https://api.sondahub.com/2010-04-01/Accounts/AC0123456789abcdef0123456789abcdef/Messages.json \
  -u AC0123456789abcdef0123456789abcdef:sandbox_auth_token \
  --data-urlencode "To=+15005550001" \
  --data-urlencode "From=+15005550006" \
  --data-urlencode "Body=Hello from the sandbox"

curl -X POST https://api.sondahub.com/verify/v2/Services/VA9e3779b1a66a4f2521a9b986b06b5d9e/Verifications \
  -u AC0123456789abcdef0123456789abcdef:sandbox_auth_token \
  --data-urlencode "To=+14155550100" \
  --data-urlencode "Channel=sms"

curl -X POST https://api.sondahub.com/verify/v2/Services/VA9e3779b1a66a4f2521a9b986b06b5d9e/VerificationCheck \
  -u AC0123456789abcdef0123456789abcdef:sandbox_auth_token \
  --data-urlencode "To=+14155550100" \
  --data-urlencode "Code=123456"

curl "https://api.sondahub.com/lookups/v2/PhoneNumbers/+14155550100?Fields=line_type_intelligence" \
  -u AC0123456789abcdef0123456789abcdef:sandbox_auth_token

The seed account’s Verify service is VA9e3779b1a66a4f2521a9b986b06b5d9e; create your own with POST /verify/v2/Services. The code that approves is the first CodeLength digits of 1234567890 — 123456 by default.

Magic numbers

Twilio’s test-credential numbers, doing what Twilio documents them to do — refused when the API is called, with Twilio’s error code.

Messages

Calls

After the answer: the sandbox’s own numbers

Twilio’s test credentials stop at the API call; these go further, ending the way a real message or call can end. They are fictional 555-01xx numbers.

The account owns +15005550006, +14155550123, +12125550142, +13125550187, +16175550164. Buying with PhoneNumber=+15005550000 answers 21422, +15005550001 21421, AreaCode=533 21452; any other area code gets a number.

Status callbacks, signed

Give StatusCallback and the sandbox POSTs the status changes to it — for a message sent then delivered (or undelivered with ErrorCode); for a call the StatusCallbackEvents you ask for (initiated, ringing, answered) and always how it ended. A call’s Url is fetched when it is answered, as Twilio fetches your TwiML. Every request carries X-Twilio-Signature: HMAC-SHA1 of the URL and the sorted form fields, keyed with the auth token you called with.

from twilio.request_validator import RequestValidator

# Flask: the full URL Twilio called, the form fields, the header
ok = RequestValidator('sandbox_auth_token').validate(request.url, request.form, request.headers.get('X-Twilio-Signature'))

Simulate an incoming SMS

Twilio calls your app when a message arrives. This sends your webhook exactly that request — the form fields Twilio sends, signed with your auth token — and shows what your app answered, TwiML <Message> replies picked out.

What it answers

Lists page with PageSize and Page and answer Twilio’s envelopes (next_page_uri, Verify’s meta); errors are {"code", "message", "more_info", "status"} with Twilio’s codes. Verify allows five sends and five checks per verification and expires it after ten minutes.

Also on sondahub

Fake REST API · Public GraphQL API · gRPC-Web & Connect · WebSocket test server · SSE test server · Public MQTT broker · MCP test server · MCP OAuth test server · Writes that persist · OpenAPI mock server · Webhook tester · Chaos and rate limits · SAML test IdP and SP · SCIM 2.0 test server · OAuth 2.0 test server · Auth test endpoints · HTTP test endpoints · Fake JSON data · JSONPlaceholder alternative · Stripe sandbox

The mock APIs themselves: fake e-commerce API, fake IoT API, fake banking API, fake social media API, fake helpdesk API, fake flight booking API, fake user directory API. Built as the playground for LockFlare Sonda, the API client that lives on your computer.