- Shipped
- September 6, 2026 at 10:33 PM UTC
- Author
- Kamo
- Commit
- 60bc5a5
Records what voipservice 9e9e814 and ea6d631 established, because the reasoning is not recoverable from the diff. A Telnyx messaging profile has exactly one webhook URL, so every Telnyx text arrives at the same endpoint no matter how Kamo models the provider — as a carrier, or as a phone server. Both shapes are now handled, and they ingest under different rails because the rail decides which factory may reply and the two disagree while sharing a URL. The safety rule is the part worth writing down: only a phone server from the same company as the webhook's carrier may verify its posts. The endpoint is unauthenticated by construction, and two of the existing phone providers verify webhooks with `return true`, so without that check a number routed at either would have been an injection point into an organization's threads.