Programmable Messaging API · View 09 of 22 · Structure
Decisions
- The two carrier-facing inbound endpoints are treated as public and hostile: verified by signature where offered, by source allowlist plus a per-route secret where not.
- Every outbound channel sits behind one internal adapter contract, so a new channel is an adapter and a route family rather than a change to the spine.
- Tenant callbacks are at-least-once with a dead-letter path, and pull is the fallback of record.
Assumptions
- Inbound acknowledgement to the carrier p99 ≤ 250 ms, inside every integrated carrier's delivery timeout.
- Perhaps a fifth of the catalogue can push; the rest is polled or webhook-driven per provider.
Accepted warning
- The route checker reports one clutter warning on this view: the "send" label lies across the tenant-callback line. Eight interfaces were tried and produce four such warnings; four interfaces produce one. The two omitted interfaces are named in the diagram note and drawn in views 10, 14 and 18.
