---
title: "Inbound SMS webhook (Twilio)"
method: POST
path: "/v1/webhooks/sms/{webhook_path}"
tags: ["Channels"]
---

# Inbound SMS webhook (Twilio)

`POST /v1/webhooks/sms/{webhook_path}`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/webhooks/sms/{webhook_path}`
- Auth: none required

Called by Twilio when someone texts the channel's number. Public, because
the provider calls it — so the `X-Twilio-Signature` header is the only
thing establishing that a message is genuine, and it is verified over the
exact public URL and every POST parameter.

A verified signature proves the message came from Twilio, **not** that it
came from the right person: anyone who knows the number can text it and
their message arrives correctly signed. So the sending number must also
match a *verified* SMS notification target.

A reply may decide an approval only when its server-derived
`risk_tier` is 1. Anything higher is answered with a link to confirm in
the app; replying cannot decide it. When more than one approval is
pending, a bare YES/NO is answered with a request for the reference code
rather than applied to a guess.

Always answers 200 with TwiML — a non-2xx makes Twilio retry a message
that was deliberately refused. The exception is a bad signature, which is
403, because a persistently failing signature is a misconfiguration as
often as an attack and silence would hide both.

## Path parameters

- `webhook_path` string, required

## Headers

- `X-Twilio-Signature` string, required

## Response `200`

TwiML response; `<Response/>` when there is nothing to reply

## Other responses

- `403`: Insufficient permissions
- `404`: Resource not found

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/ae109b496830?raw)