One relay, two ways to send.

Two endpoints sit in front of the upstream SMS gateway: a JSON POST for batches (current, recommended), and a single-recipient GET kept for backward compatibility. Same credentials, same rules, one place to integrate.

Your app

client

This relay

proxy.p10solutions.com

Upstream

smsportal.exabytes.my

un + pwd checked → rate limit applied → request forwarded → response relayed back

◆

Internal development docs — read before changing anything

This exists as a proxy, not a feature. The upstream gateway (smsportal.exabytes.my) only accepts requests from a whitelisted set of source domains/IPs. Rather than whitelisting every app or server that needs to send SMS, all of them route through this one domain — proxy.p10solutions.com — which is the single whitelisted caller on record with the upstream.

If this domain, subdomain, or its server IP ever changes (new host, new DNS, migrated cPanel account, etc.), the upstream will start rejecting requests until Exabytes is asked to whitelist the new domain/IP. Raise that with them before cutting over, not after.

Endpoint 01 · Current

Send to multiple recipients

JSON body request. One call fans out to many numbers — order updates, appointment reminders, batch notices. This is the version to build new integrations against.

Recommended

POST /api/isms_send_json.php

Accepts a JSON body and forwards it unchanged to the upstream gateway.

Body fields

Name	Required	Description
un	Required	Account username. Checked against an allow-list.
pwd	Required	Account password. Must match the value on file for `un`.
type	Required	Message type code, e.g. `1`.
sendid	Required	Sender ID shown to the recipient.
agreedterm	Required	Must be `YES` to confirm terms acceptance.
messages	Required	Non-empty array of `{ dstno, msg }` objects. Capped at 100 per request.
messages[].dstno	Required	Destination mobile number for that message.
messages[].msg	Required	Message body for that recipient.

ℹ️

Body is forwarded as-is. The relay does not re-encode your JSON — the exact bytes you send are what reach the upstream gateway, so field order and formatting are preserved.

Example request

curl -i -X POST "https://proxy.p10solutions.com/api/isms_send_json.php" \
  -H "Content-Type: application/json" \
  -d '{
    "un": "YOUR_USERNAME",
    "pwd": "YOUR_PASSWORD",
    "type": "1",
    "sendid": "YOUR_SENDERID",
    "agreedterm": "YES",
    "messages": [
      { "dstno": "60123456789", "msg": "Hi Ali, your order #123 is ready for pickup" },
      { "dstno": "60123456789", "msg": "Hi Siti, your appointment is confirmed at 3pm" }
    ]
  }'

Endpoint 02 · Classic

Send a single message

Query-string request, single recipient only. Kept for backward compatibility with older integrations — new work should use the JSON endpoint above instead.

Classic · Deprecated

GET /api/isms_send.php

Forwards all query parameters to the upstream gateway and returns its exact response.

⚠️

Obsolete — do not build new integrations on this. It only supports one recipient per request. Still supported for existing callers, but new work should target /api/isms_send_json.php above.

Parameters

Name	Required	Description
un	Required	Account username. Checked against an allow-list.
pwd	Required	Account password. Must match the value on file for `un`.
dstno	Required	Destination mobile number, international format, e.g. `60123456789`.
msg	Required	Message body, URL-encoded.
type	Required	Message type code, e.g. `1`.
sendid	Required	Sender ID shown to the recipient.
agreedterm	Required	Must be `YES` to confirm terms acceptance.

Example request

curl -i "https://proxy.p10solutions.com/api/isms_send.php?un=ASX&pwd=YOUR_PASSWORD&dstno=60123456789&msg=Hello%20World&type=1&sendid=ASX&agreedterm=YES"

Reference

Limits & response codes

Both endpoints share the same authentication rules, rate limits, and status codes.

200–3xxRelayed as-is from upstream

400Malformed body or missing messages

403Unknown un or wrong pwd

405Wrong HTTP method for that endpoint

429Rate limit exceeded — see Retry-After

502Upstream gateway unreachable

Auth

Credentials, not just username

un and pwd are both checked against a hardcoded allow-list. A wrong password is rejected the same as an unknown username — no hints either way.

Rate limits

Shared across both endpoints

Limits apply per source IP and per account, and count identically whether you call the GET or the JSON endpoint.

Delivery

Status is passed through

Once authenticated, the relay forwards your request as-is and returns the upstream gateway's exact HTTP status and body.