- Shipped
- October 14, 2026 at 4:12 PM UTC
- Author
- Kamo
- Commit
- 2a69b6a
A form-encoded post (Twilio, Sinch, Vonage pointed at the wrong address) fell into readTree(), failed, and was answered 200, so the carrier never retried and the text - a STOP included - was discarded. A form post is now refused 415 before the body is read, with a log line naming the instance, the field names (never values) and the carrier address it belongs at (/api/bulktext/inbound/twilio when the fields are Twilio's). It is not forwarded: Twilio signs the exact URL it called. Any other body that is not JSON answers 400 with the instance logged. JSON events keep their 200.