# Sinch Engage
> The Sinch APIs provide powerful business messaging capabilities across sending, receiving, and processing SMS, MMS, and rich messaging. All requests to the Sinch REST API must be authenticated, this can either be done using Basic Authentication or by signing with a HMAC signature.
## Authentication
All requests must include an Authorization header using either Basic Authentication or an HMAC-SHA256 request signature (which additionally requires a Date header, and a Content-MD5 header on requests with a body). Use the EU base URL https://eu.app.api.sinch.com or the APAC base URL https://au.app.api.sinch.com depending on your account's region. Parent-account credentials can act on behalf of a sub-account via the Account header (see Guides). A 401 response means the Authorization header was missing, malformed, or does not match your account's API key/secret; an API key and secret are issued when you sign up for a developer account (see the support portal under Guides).
- [Basic Authentication](https://developers.app.sinch.com/docs/guides/basic-authentication.md): Authenticate with a Base64-encoded API key/secret in the Authorization header.
- [HMAC Authentication](https://developers.app.sinch.com/docs/guides/hmac-authentication.md): Sign requests with an HMAC-SHA256 signature for extra request integrity.
## Endpoints
Most endpoints are versioned under /v1/ and exchange JSON; Messaging Reports' async report endpoints instead use /v2-preview/ and additionally accept a Bearer JWT (see that service below). Endpoints are grouped below by service; each linked page documents parameters, request/response schemas, and inline code samples for that service. Successful responses return a 2xx status: 200/202 for most send/poll/ report operations, 201 for many create operations, and 204 (no body) for some updates/deletes. 4xx responses return a JSON error body describing what was invalid (the exact error schema varies by service -- see each endpoint's response table for specifics), and 401 responses indicate invalid, missing, or mismatched credentials for that endpoint's supported auth scheme(s).
- [Messages](https://developers.app.sinch.com/docs/api/messages/index.md): Send SMS, MMS, and TTS messages (up to 100 per request, content up to 5,000 characters, destination in E.164 format); poll status or cancel a scheduled message by ID.
- [Delivery Reports](https://developers.app.sinch.com/docs/api/delivery-reports/index.md): Poll or receive webhooks for message delivery status changes as a message is processed toward a handset.
- [Replies](https://developers.app.sinch.com/docs/api/replies/index.md): Check and confirm inbound (MO) replies sent from a handset back to a previously sent message.
- [Source Address](https://developers.app.sinch.com/docs/api/source-address/index.md): Request an SMS sender ID (alphanumeric, international number, or short code) and track its registration/approval status.
- [Number Authorisation](https://developers.app.sinch.com/docs/api/number-authorisation/index.md): Manage your account's opt-out blacklist; Sinch adds numbers automatically when recipients reply with an opt-out keyword (e.g. STOP).
- [Dedicated Numbers](https://developers.app.sinch.com/docs/api/dedicated-numbers/index.md): Search available numbers, assign them to your account, and configure or release assignments (paid feature; must be enabled on your account).
- [Webhooks Management](https://developers.app.sinch.com/docs/api/webhooks-management/index.md): Subscribe to, retrieve, update, and delete webhook configurations that push delivery reports and replies to your callback URL.
- [Signature Key Management](https://developers.app.sinch.com/docs/api/signature-key-management/index.md): Manage signature keys used to verify that inbound webhooks genuinely came from Sinch and not a third party.
- [Messaging Reports](https://developers.app.sinch.com/docs/api/messaging-reports/index.md): Run synchronous and async summary/detail reports on messages sent and received through your account.
- [Short Trackable Links Reports](https://developers.app.sinch.com/docs/api/short-trackable-links-reports/index.md): Query click logs for the short, trackable links Sinch automatically generates from URLs in your message content.
- [Contacts](https://developers.app.sinch.com/docs/api/contacts/index.md): Manage Contacts, Contact Lists, and Custom Fields used to organize and target message recipients.
- [Account Management](https://developers.app.sinch.com/docs/api/account-management/index.md): Create and delete reseller sub-accounts and add Sinch Engage users on a reseller account (POST /v1/iam/reseller_customers, POST /v1/iam/accounts/{id}/users, DELETE /v1/iam/accounts/{id}).
## Code Samples
Most endpoint Markdown pages (see Endpoints above) include inline cURL and JavaScript request examples showing the required Authorization header and a JSON request body for that operation. No separate SDKs are published; samples are plain HTTP so they work with any client without a dependency on a Sinch/MessageMedia SDK.
## Guides
Guides cover behaviour that spans multiple endpoints rather than a single operation, and are not tied to any one service tag below. See the support portal below for broader Sinch Engage onboarding and troubleshooting content that sits outside the API reference itself.
- [Sub-accounts](https://developers.app.sinch.com/docs/guides/sub-accounts.md): Perform actions on behalf of a sub-account using the parent account's credentials and an Account header, supported on Messages, Replies, Delivery Reports, Webhooks, and Source Address.
- [AI Integration](https://developers.app.sinch.com/docs/guides/ai-integration.md): The agent-readable artifacts published with these docs (llms.txt, llms-full.txt, per-page Markdown, openapi.yaml/json), their discovery tags, per-tool setup for Claude Code/Cursor/ChatGPT/Perplexity, and the versioning conventions.
- [Full developer guide hub (support portal)](https://support.app.sinch.com/hc/en-us/categories/10516535548943-Sinch-Engage-Developer-Guides): Additional Sinch Engage developer guides, onboarding articles, and support content beyond the API reference.