intouch API Overview: Auth, Endpoints & Message Lifecycle

The intouch API is a REST/JSON API, hosted in AWS Sydney (ap-southeast-2), that sends SMS and MMS over Australian carrier routes, manages wallet passes, and reports delivery back to you. Authentication is OAuth2 client credentials; every send returns a transaction ID you can trace end to end. This page is the technical overview an architect needs for vendor due-diligence — the interactive explorer with the full schema lives at apimobiledigital.com.

Last reviewed: 22 August 2026.

Authentication

The API uses OAuth2 client-credentials flow. You exchange your client ID and secret at the token endpoint, then send the bearer token on every request:

POST {BASE_URL}/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id={ID}&client_secret={SECRET}

Authorization: Bearer {ACCESS_TOKEN}

Scopes are role-based: read, write and admin cover the core messaging API; the gifting/verification module uses its own scope family (gifting:send, gifting:links, gifting:webhooks and related). A request with a valid token but missing scope returns 403; a missing or expired token returns 401. POST /test-oauth2 exists purely to validate your token before you wire anything else — start there.

Core endpoints

Beyond core messaging, the same API surface exposes wallet endpoints (/wallet/pass-link, /wallet/push, /wallet/audiences — create pass links, push updates to installed passes, manage audiences) and an optional gifting and verification module with fraud-screened delivery links. Those get their own guides; this overview stays on messaging.

Message lifecycle

1. Submit. Your POST is validated (auth, scope, payload). A successful submission returns result, a transId (transaction ID) and a log_uuid.
2. Route. The message is queued onto MobileDigital's Australian carrier routes. MMS media (PNG, GIF, MP4) travels base64-encoded in the request and is transcoded for handset delivery.
3. Deliver. Carrier delivery receipts flow back and are recorded against the transaction.
4. Trace. POST /traceTransactionId (or webhooks for push-style updates) gives you the current state by transId — the same ID your tracking_id correlates to in your own systems.

Request conventions worth knowing

• tracking_id — your own correlation ID, echoed back so you can join delivery data to your records without storing ours.
• transactional: true — marks a message as transactional (non-promotional), which overrides marketing opt-in preference checks. Use it only for genuinely transactional content: under the Spam Act that flag is a legal classification, not a delivery optimisation. Our compliance guide covers the boundary.
• is_alpha — send SMS from an alphanumeric sender ID (max 11 characters). AU sender IDs must be registered under ACMA's SMS Sender ID Register; MMS always uses a dedicated virtual number (from).

Errors and limits

Authentication errors are conventional: 401 invalid/missing token, 403 valid token but insufficient scope. Payload validation failures return a result: false body with a reason rather than silently dropping — log log_uuid in your error handler; it's the fastest path for support to find your exact request. Throughput is provisioned per account and route; tell us your peak volumes and we'll size accordingly.

Where to next

• Send your first MMS — working curl example in under five minutes.
• Webhooks — push delivery events into your systems instead of polling.
• Building on Salesforce Marketing Cloud? The Journey Builder integration wraps this API so you may not need to touch it directly.