# A core-node HIGHWAY SMS API example: disabled import, dry run and explicit response handling

**URL:** <https://discourse.nodered.org/t/a-core-node-highway-sms-api-example-disabled-import-dry-run-and-explicit-response-handling/101966>\
**Category:** Share Your Projects\
**Created:** [21 October 2026 18:52 UTC](https://discourse.nodered.org/t/a-core-node-highway-sms-api-example-disabled-import-dry-run-and-explicit-response-handling/101966 "2026-10-21T18:52:28Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![kanta-dev81](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/kanta-dev81/32/108683_2.png) [@kanta-dev81](https://discourse.nodered.org/u/kanta-dev81)\
**Post date:** [21 October 2026 18:52 UTC](https://discourse.nodered.org/t/a-core-node-highway-sms-api-example-disabled-import-dry-run-and-explicit-response-handling/101966/1 "2026-10-21T18:52:29Z")

</div>

Disclosure: I am involved with FoxBox. This is an example from our project, shared so that people integrating an SMS appliance can inspect the request path and its limitations. It is not a Node-RED endorsement or a production delivery claim. This write-up was prepared with AI assistance from our source and test records.

The flow is already available in the Flow Library:

> **[FoxBox HIGHWAY v1: manual SMS request with a safe default (flow) - Node-RED](https://flows.nodered.org/flow/a5e629302c888f9d2a80602968be30ea)**

It uses core nodes to call the HIGHWAY v1 web-services interface directly. This is a different path from the external-bridge prototype described in our wider integration guide.

The import deliberately starts disabled. The Inject node is manual, with no repeating schedule. After the tab is enabled, the request builder still starts in dry-run mode: enabling a tab alone should not send an SMS. This makes it possible to inspect the configuration before deliberately arming transport.

The request is an application/x-www-form-urlencoded POST to /index.php, with app=ws and op=pv. The username and Webservices token belong in the protected runtime configuration, outside the exported flow. TLS certificate validation remains enabled; redirects and automatic retries are disabled. A local interval limits repeated manual attempts, while the Debug path exposes a redacted result rather than the complete request.

One design decision matters particularly for notifications: a timeout is an ambiguous result. The gateway may have accepted a request before the connection failed. Automatically retrying it can create duplicate messages. This example leaves that decision visible instead of treating every transport failure as permission to resend.

The recorded isolated run used Node-RED 5.0.8, Node.js 25.2.1 and the official test helper 0.3.6. It passed 22 checks and made 13 requests to a localhost mock. Cases included disabled import, dry run, missing configuration, invalid input, rate limiting, authentication and server errors, redirects, unexpected response bodies and a closed local transport. No external gateway was contacted and no SMS was sent. These results do not establish compatibility with every Node-RED release, gateway firmware or carrier network.

Before using your own gateway, read the Info panel in the imported tab and compare the documented contract with your deployed HIGHWAY version. The example is GPL-3.0-or-later; its provenance is recorded in that panel.

For your own Webservices token, open the gateway’s username menu → Settings → User configuration → Application options. Keep the token private; do not paste it into a shared flow, screenshot or forum reply. If access is disabled, the account administrator must review the appropriate settings and IP access range.

API setup and token instructions:

> **[Enterprise SMS API | Secure & Scalable SMS Gateway | FoxBox](https://www.smsfoxbox.it/enterprise-sms-api/)**
>
> Explore FoxBox REST SMS API with secure authentication, high delivery performance and enterprise integration support for CRM, IoT, logistics and SaaS platforms.

Complete manual, chapter 12, User profile and account configuration:

> **[FoxBox Administration and User Manual](https://www.smsfoxbox.it/manual/FoxBox_Complete_Manual_EN.html)**

I would welcome concrete feedback on the flow’s response handling and the boundary between an accepted API request and an unknown transport outcome. Please use synthetic examples and redact any account, recipient or event data.