# iMessage API gap map: what Blooio and its rivals sell, what this build runs today, and the twelve gaps between them

slug: imessage-api-gap-map · https://miscsubjects.com/a/imessage-api-gap-map · category: build · tags: imessage, messaging-api, blooio, gap-map, build · updated 2026-09-22T06:16:29.322Z

The iMessage API gap map answers one question: can this build sell what Blooio sells, plus three things Blooio does not (a customer's own number cloned and tracked, an AI model provisioned with the number, and the customer's automations managed in the same place), and what stands between today and that product. The answer, in one line: the build already runs most of Blooio's request surface and all three extras, and the one thing it cannot make is an iMessage phone number, which it must rent from Blooio or let the customer bring on their own Mac. Everything below is measured on 2026-09-21 from the vendors' published documents and from the build's own live endpoints.

Four terms, defined once. An **iMessage API vendor** is a company that owns Apple devices with phone numbers registered to iMessage and lets a customer send through them by HTTP; none of them is an Apple program, and every one of them warns that an Apple ban on a number is permanent. A **directory row** is one capability in this build, callable as `POST /api/dispatch {"key": "...", "body": "..."}` and answering with a public receipt. A **build sheet** is a stored grid on miscsubjects.com whose cells can hold formulas that call rows. A **tenant** is one customer's isolated copy of the build's runtime, a Worker inside a Cloudflare Workers for Platforms dispatch namespace.

Five reference pages carry the vendors, one object per page: [Blooio](/a/blooio), [Sendblue](/a/sendblue), [Linq](/a/linq), [LoopMessage](/a/loopmessage) and [myCRMSIM](/a/mycrmsim). The full inventory behind the map sits in two build sheets: [every Blooio endpoint, MCP tool, webhook event and plan, with the build's equivalent row and its measured state](https://miscsubjects.com/admin/sheets?tab=sh_feevfx8s), 246 rows, and [the vendor-by-feature matrix](https://miscsubjects.com/admin/sheets?tab=sh_mrkkvamh), 41 rows.

## What the four vendors sell is the same object with different limits

Blooio, Sendblue, Linq and LoopMessage sell the same object: a phone number on a Mac or iPhone the vendor owns, a send endpoint, a webhook, and a set of iMessage-native extras (reactions, typing, read receipts, polls, cards, effects). The differences are in the limits and the price.

Blooio prices every plan in public: $39 a month for a shared line with 5 new contacts a day, $109 for a dedicated reply-only line, $289 for a dedicated outbound line, and $195 to $389 per line on the enterprise tier; its pricing document promises "no per-message fees" on all of them. Sendblue publishes one price, $100 per line per month for an inbound-first line with 1,000 inbound contacts a day, and quotes the outbound plan by sales call. Linq publishes no price at all and sells a free sandbox next to an enterprise contract. LoopMessage prices by unique daily contacts, $59.99 for 300 and $99.99 for 1,000, with $15 add-ons for a phone number and for SMS fallback. myCRMSIM is the outlier: the customer's own SIM in the customer's own handset; Blooio's comparison page prices it at $29 a month plus the hardware and the carrier plan.

The limits are the product. Blooio lets a new chat receive 3 messages before a reply and pauses a line whose new-chat reply rate falls under 40%. Sendblue allows 50 new outbound contacts a day per line and 5 messages to a contact who has not answered. Linq recommends 7,000 messages a day per line and hard-limits 30 messages per minute per pair. LoopMessage refuses cold outbound outright: "we do not support outbound-only messaging where you do not expect any interaction or response from the recipient." Every vendor is metering the same scarce thing, Apple's tolerance for a number, and every vendor's safety engine is the mechanism that keeps its fleet alive.

Two facts from the vendors' own pages bear on trust. Sendblue disclosed on 2026-08-05 that a misconfiguration in its Firebase and Firestore rules "led to unauthorized access to certain conversation records". Linq offers a zero-day-retention mode in which message content "is never persisted past the moment it's needed", and is the only one of the four asserting a SOC 2 Type II certificate; Blooio describes itself as "SOC 2–aligned".

## What the build runs today, measured

The build is a Blooio customer. Its inbound webhook at `/blooio` answers Blooio's signed post, queues the message, runs a router agent, hands the turn to a named agent row with tools, and sends the reply back through Blooio; voice memos are transcribed first, photos are stored as reference assets, and the reply can be spoken as audio. The send path in code calls Blooio's v2 endpoint for phone-addressed chats and Blooio's v4 MCP tool `send_chat_message` for chat-id-addressed ones.

Counted from the directory on 2026-09-21: 121 rows carry messaging. Sixty-seven are `BLOOIO_*` rows that mirror Blooio's v4 MCP tools one for one (`BLOOIO_SEND_POLL`, `BLOOIO_ROTATE_WEBHOOK_SECRET`, `BLOOIO_LIST_LOCATION_CONTACTS` and the rest); two of them are marked as tested and working, `BLOOIO_LIST_CONTACTS` and `BLOOIO_LOGS_TAIL`, and the other sixty-five exist with real invocation envelopes and have never been fired by the test runner, which is a choice rather than a defect: most of them send, react, or delete, and the test runner refuses outward side effects.

Thirty-five are `IMSG_*` rows that read and write the owner's own Messages.app on a Mac, through a bridge at `agent.miscsubjects.com`. The contract page for that surface states its identity plainly: "Native iMessage API. Sends and reads as the Mac Messages.app Apple ID — not Blooio." Twenty-two of the thirty-five are measured as working, among them `IMSG_SEND`, `IMSG_SEND_CHAT`, `IMSG_HISTORY`, `IMSG_SEARCH` over 673,000 stored messages, `IMSG_AFTER` (a cursor over every new message), `IMSG_REPLY`, `IMSG_REACT_LATEST`, `IMSG_SCHEDULED` and `IMSG_WHOIS`. Twelve are marked broken: typing, read receipts, edit, unsend, unreact, reaction by message id, create chat, activity, load attachment, mark unread and two list verbs. The executor's own status reply on 2026-09-21 (imsg 0.15.3) explains the split: it reports `typing_indicators: false`, `read_receipts: false` and `v2_ready: false`, and says "Advanced IMCore features are intentionally disabled" while System Integrity Protection is on. The broken twelve are the verbs that need those features or the second, accessibility-driven executor. One row, `IMSG_SEND_FILE`, is untested.

The remaining rows are WhatsApp through 2chat (`TWOCHAT_*`), a Matrix message bus (`MSG_*`), a Telegram path inside `SEND_BY_CHANNEL`, and Twilio SMS gated behind a flag that stays off until carrier registration completes.

## The cell model the question asked for is already live

The question came with a shape: a large REST JSON object that sends one number a text in column one, a tiny script that invokes it, and the returned payloads in columns two and three. That shape is a build sheet today, and no script is needed. The sheet contract describes the grid: "Every cell is A1-addressable over REST; whole tabs are sheets: Directory and Ledger are projections of their own tables, user sheets store cells here." Three formulas do the work: `=INVOKE(A2)` returns the payload of the REST envelope in A2, `=INVOKE(A2,"status")` returns the transport record, and `=INVOKE(A2,"verdict")` returns a green or red verdict.

The [demo sheet](https://miscsubjects.com/admin/sheets?tab=sh_srsn7axk) was built on 2026-09-21 with six rows. Row 2 holds the envelope of `BLOOIO_LIST_CONTACTS` in column A; column B evaluated live to `{"http":200,"ok":true,"ms":2140,"trace_id":"t_vi5pb81i",...}` with a link into the ledger, column C to `{"data":[],"has_more":false,"next_cursor":null}`, and column D to a green verdict. Row 3 does the same for `IMSG_STATUS`, the owner-Mac executor's health, in 3,995 ms. Rows 4 to 6 hold the envelopes of the three send rows, `BLOOIO_SEND_CHAT_MESSAGE`, `IMSG_SEND` and `SEND_BY_CHANNEL`, with columns B to D left empty on purpose: typing `=INVOKE(A4)` into C4 sends the message. A send row was not fired while building the sheet because its example arguments are real recipients.

The equivalent JavaScript, for a reader who wants a script rather than a cell, is a sheet script: a stored row whose code runs with `input` (the rows), `misc.run(key, body)` (a real dispatch with its own receipt) and `sheet.set(range, values)` in scope, fired by writing its `run_now` cell. Blooio, Sendblue and Linq have no spreadsheet surface; the nearest thing any vendor offers is Sendblue's Zapier action, which batches up to 29 numbers.

## What the build has that no vendor sells

Four things on the build's side of the map have no counterpart in any of the four vendors' documents.

The customer's own number, cloned and tracked. The `IMSG_*` rows read the Mac's message store directly and send as the owner's Apple ID; the watcher appends every inbound and outbound message to a local log and posts a metadata-only row to the ledger. Blooio states it is "not a peer-to-peer BlueBubbles plugin"; Sendblue, Linq and LoopMessage rent their own identities only; myCRMSIM comes closest, a personal SIM bridged into a CRM, but exposes no message history, search, or watch cursor.

The model in the row. A build agent is a directory row holding a prompt, a model id and a tool list, and an inbound text reaches it through the router without any glue. Blooio's Inbound plan hands the customer a webhook and says, in its own words, "your AI agent (custom LLM, ChatGPT, Claude, n8n flow, etc.) can classify and reply"; the model is the customer's problem. Sendblue offers a chatbot template and cloud sandboxes; Linq offers a Claude plugin. None of them provisions the model with the number.

A receipt per call. Every dispatch answers with a public receipt page and a trace id that resolves in the ledger; Linq comes nearest with a trace id on every response, Blooio with a webhook delivery log.

Tenancy. Workers for Platforms is bought and live on the build's account, with a `production` dispatch namespace and a one-command clone (`node scripts/cf-tenant.mjs clone <source> <new-name> --ns=production`). A customer's copy of the runtime is a user Worker with its own settings in KV, reachable only through one gate. Blooio's equivalent is an organization with API keys and channel assignment; it isolates data, not code.

## The gaps, each with the layer that closes it

Twelve gaps separate what the build runs from what a customer could be sold. Each is stated with the layer where the fix lives, because a gap named without its layer is a wish.

1. Number supply. The build cannot mint an iMessage number. Blooio's v4 Number Purchase API can: "The Number Purchase API lets you provision Blooio lines from your own code instead of clicking through the dashboard." Three gates precede the first purchase: identity verification through Stripe Identity, a staff-approved access request, and a card on file; a single order is capped at 10 lines. Layer: a Blooio organization enrolled as a reseller, plus a `BLOOIO_PURCHASE_LINE` row wrapping `POST /channels/blooio/purchases` with a required idempotency key and a `number.purchase.completed` handler. Cost floor per customer line: $109 reply-only, $289 dedicated, $195 to $389 enterprise, all monthly.

2. Per-customer keys and channel ownership. Blooio lets an OAuth app holding `apikeys:manage` mint an API key per customer organization and assign a line to it. The build has share tokens scoped to rows and team links with levels, and no third-party OAuth server. Layer: the tenant gate, which already holds one Blooio key per line and can hold one per tenant.

3. A safety engine on the build's own identities. Blooio's conversation states (3, 3, 4, 6, 8 consecutive messages by state) and number actions (queue, slow, pause_new, reply_only, review) exist to keep a fleet alive. On a rented Blooio line the engine is Blooio's. On a customer's own Apple ID it is nobody's; the build has a silenced-groups list and an autorun switch. Layer: counters in the tenant's KV keyed by chat and by line, enforced inside `SEND_BY_CHANNEL` before the send, with the same state names as Blooio's so a customer moving between doors reads one vocabulary.

4. Outbound webhooks as a product. The build verifies Blooio's signatures on the way in and has a one-line webhook creator for its own use; it does not yet sign, log, retry and replay events out to a customer's URL. Layer: one queue consumer per tenant with an HMAC over `{timestamp}.{body}`, a deliveries table, and a replay verb.

5. Channel routing. Blooio's priorities (tiers, sticky pools, waterfall) and hybrid mode (SMS first, iMessage after a reply) are a routing engine; the build's `SEND_BY_CHANNEL` is a switch on one word. Layer: a per-tenant ordered channel list in KV read by the same verb.

6. The twelve broken own-number verbs. Typing, read receipts, edit, unsend and reaction by id fail because the Mac executor runs with System Integrity Protection on. Layer: either the executor's advanced mode on a dedicated Mac, or the accessibility-driven executor repaired; the row states already say which verb is which.

7. Fleet and ban handling. Blooio's enterprise tier rotates a banned number out and replaces it. The build has two rented lines and one Apple ID. Layer: the purchase row from gap 1 plus the `number.removed` event.

8. iMessage extras with no row yet: message effects (none of Blooio's specifications carry them; Sendblue lists 13 and Linq 15), custom bubbles, Find My and Check In bubbles, FaceTime call links, calendar invites, link-preview overrides. Layer: sixty-five untested `BLOOIO_*` rows already cover polls, cards, backgrounds, location and reactions; the rest are new rows over Blooio's v4 fields.

9. Contacts as a customer-facing object. Blooio ships contact CRUD with identities, tags, merge and a timeline; the build keeps its own leads tables. Layer: expose the tenant's contacts as a build sheet with the same columns.

10. Packaging. Blooio ships SDKs in four languages, a hosted MCP server with 61 tools, and connectors for GoHighLevel, n8n, Make and Zapier. The build ships a per-row invocation compiler (curl, JavaScript and Python spellings on `/tools`) and a hosted MCP server over every row, and no connectors. Layer: the compiler already emits the spellings; the connector packages are the missing artifacts.

11. Analytics and inbox. Blooio's dashboard shows delivery, engagement and a warming tracker. The build shows every call in the ledger and the Console. Layer: a tenant view over the ledger, which is a sheet.

12. Compliance. Linq asserts SOC 2 Type II, Sendblue SOC 2 Type II and HIPAA, Blooio "SOC 2–aligned"; the build asserts nothing. Layer: an audit, which no code closes.

## The product, stated as the customer would meet it

The product the question described is three doors and one room.

Door one, clone your number: the customer installs the Mac bridge, the watcher starts at the last message id, every message in and out becomes a row with a receipt, the full history is searchable, and the customer's own Apple ID sends. Nothing is rented; Apple's tolerance for the customer's own number is the only limit, and gap 3's counters are what keep it.

Door two, get a number: the tenant gate buys a Blooio line through the purchase row, assigns it to the tenant's key, and points the line's webhook at the tenant's Worker. Blooio's safety engine and fleet handling come with the line. The cost floor is Blooio's per-line price.

Door three, both: the rented line for outbound and cold contact, the customer's own number for the relationships that already exist, one `SEND_BY_CHANNEL` verb choosing between them.

The room is the same for all three: an agent row with the customer's prompt and model, automations as rows that the customer edits in place, and the sheet as the control surface where a REST envelope in column A becomes a payload in column C. The tenant is a user Worker; the provider keys live in one outbound worker that logs every call; the customer sees their own ledger.

## Measured on 2026-09-21: four aliases of one Apple ID against the build's Blooio line

The owner's Apple Account carries four iMessage aliases: two phone numbers and two email addresses. Six messages were exchanged between that account and the build's Blooio line in one sitting, every one of them a row in the Mac's message store and a receipt on the ledger.

| leg | from | to | result |
|---|---|---|---|
| Mac, existing chat (alias: first number) | the owner's Apple ID | Blooio line | row 679688, sent; Blooio fired `message.received`; the build's router answered within 22 seconds (row 679691) |
| Blooio line | the owner's first number | Mac | row 679689, received on the first number |
| Blooio line | the owner's second number | Mac | row 679690, received on the second number |
| Blooio line | the owner's iCloud email | Mac | row 679694, received on the email alias; Blooio status `delivered`, protocol `imessage` |
| Mac, same chat | the owner's Apple ID | Blooio line | row 679695, sent on the iCloud alias, because the chat's alias had moved to the last address the other side used |
| the owner's phone, "From" picked by hand | second number, then Gmail | Blooio line | rows 679692, 679693 and 679696, each stamped with the alias it left on |

Three rules fall out of the rows. On the Mac, one counterparty is one chat whatever alias is in play, and the per-message alias is recorded in the store's `destination_caller_id` column; the Mac's next send in that chat leaves on the chat's current alias, which follows the last message, and the "Start New Conversations From" setting decides the alias for a brand-new chat. On Blooio's side the same four aliases are four contacts (`ct_` ids, one per identifier) in four chats; Blooio's v4 contact merge and identity endpoints exist to fold them into one contact, and the build has an add-identity row for it. Apple's own rule for adding a number: "If you're using an iPhone, you need SMS messaging to activate your phone number with iMessage and FaceTime", so a phone number joins an Apple Account through an iPhone with that SIM, never through a Mac, and email aliases are added at account.apple.com under Sign-In and Security. Ten commercial numbers on one Apple Account therefore means ten activated iPhone lines (physical or eSIM) under that account, with any Mac signed in to it sending and receiving on all ten; that is the fleet the four vendors run. A hosted Mac to hold that session costs $109 a month for an M2 Mac mini at MacStadium on 2026-09-21, and Amazon's EC2 Mac instances bill by the second with a 24-hour minimum.

Two things were repaired in the same sitting. The Mac's inbound watcher had stopped on 2026-09-13 and was restarted under a launchd agent that keeps it alive; it now stamps every inbound and outbound message onto the ledger again. And the `BLOOIO_GET_MESSAGE_STATUS` row wraps a JSON argument into its first positional field, so the working spelling is `chat_id|message_id`.

## The final spec, second pass: three gaps withdrawn, five challenge items that remain

Three of the twelve gaps above are not gaps. Replay and pagination are reads over the ledger, where every send and receive already lands as a row; the build's phone recorder already replays any captured call by id, and a customer-facing replay is the same read pointed at a customer's URL. A webhook signing secret is the build's capability token bound to the sender: one token per line, minted like every other row token, carrying its provenance. Contacts are objects the build already holds: the Mac's address book answered a read of 410 contacts on 2026-09-21 through the Apple node, and the leads tables hold the rest; create, edit and remove are three receipted verbs over that table. What remains is five items, each with a physical or Apple-imposed constraint rather than a code one.

1. A Messages session has to be awake. The clone lives on whichever Mac is signed in and online; a closed laptop is a dead bridge. The repair is not code: Messages in iCloud already mirrors the whole history to every Mac on the account, which is how three messages typed on the owner's phone reached the Mac store within seconds on 2026-09-21. An always-on Mac on the same Apple ID (a Mac mini at home, or a hosted one at $109 a month) carries the clone while the laptop sleeps. Sold to a customer who wants their own identity cloned, that means one macOS user per customer on a hosted Mac, signed into the customer's Apple ID with the customer's second factor, a trust boundary the four vendors avoid by using their own Apple IDs. So there are two doors and no third: bring your own Mac (or rent one on your own Apple ID), or rent a line on the vendor's identity.

2. Choosing the outgoing alias on the Mac, solved the same evening by reading the signal instead of the manual. Receiving is per alias and recorded per message; sending leaves on the chat's current alias, held in the store's `chat.last_addressed_handle` column, and the messaging daemon reloads that column when it restarts. So the send verb now sets the column to the requested alias, restarts the daemon, waits for it, sends, and reads the alias back: messages 679712, 679715 and 679716 left on the second number, the first number and the second number as requested, each in 8 to 26 seconds. One message did not, 679718, because a reply from the other side landed in the seconds between the switch and the send and moved the chat's alias back; the reply reports that honestly as `from_honored: false`. A brand-new recipient has no chat row and takes the account's Start New Conversations From setting, which lives outside any user-writable file found on 2026-09-21. On a rented Blooio line the sender is a field, so the choice is free there.

3. Twelve own-number verbs need the executor's advanced mode, which needs System Integrity Protection off on the Mac that runs it, a setting to make on a dedicated machine and never on the owner's laptop.

4. Number supply per Apple Account. A $5-a-month US Mobile line activates on an iPhone by carrier SMS, an iPhone holds two active lines under Dual SIM, and Apple publishes no cap on iMessage numbers per account; the only published per-account cap is "ten devices (no more than five computers) associated with your Apple Account for purchases at one time", which governs purchases, not Messages. The limit is learned by adding lines until Apple refuses, which is a $5 experiment per line.

5. Safety counters on the build's own identities, so a customer's own number is paced the way Blooio paces a rented one; the one item of real engineering, and small: per-chat and per-line counters in the tenant's KV, read by the send verb.

The one JSON. Every sender the build has today is reached by one envelope, `POST https://ops.miscsubjects.com/api/dispatch` with the header `x-terminal-key` (or a share token scoped to the row), and a body of `{"key": ..., "body": ...}`. From a rented Blooio line, the sender is the line's channel id:

```json
{"key":"BLOOIO_SEND_MESSAGE","body":"{\"channel_id\":\"ch_019ec003-dd29-7eac-bb88-c3fc8f3661a7\",\"to\":\"+15551234567\",\"text\":\"hello\"}"}
```

The three rented lines on the account are `ch_019ec003-dd29-7eac-bb88-c3fc8f3661a7`, `ch_019ec003-dd29-7aa1-8804-1f37c9cef395` and `ch_019ec003-dd29-763d-93c1-eeb2b97948ae`. From the owner's own Apple ID, the sender is the Mac:

```json
{"key":"IMSG_SEND","body":"+15551234567|hello"}
```

The same envelope is a cell: paste it into column A of a build sheet and put `=INVOKE(A2)` beside it; the demo sheet carries all four senders in rows 7 to 10, unfired. From a terminal it is one curl with the same body. A rival command-line tool that sends iMessage from a Mac does the second envelope and nothing else; the difference here is the receipt, the ledger row, the sheet cell, and the rented lines behind the same door.

What was made on 2026-09-21, so the parity is a list and not a claim: five vendor reference pages from primary sources; the 246-row Blooio surface sheet with the build's equivalent for every endpoint, tool, event and plan; the 41-row vendor matrix; the live three-column demo sheet; a six-message round trip across all four aliases of one Apple ID against the rented line; the watcher restarted under a keep-alive agent; and the gap list corrected from twelve to five. Parity with Blooio's request surface stands at 67 mirrored rows plus the inbound loop that answers a text with an agent; parity with its number supply stands at three rented lines and the purchase API not yet enrolled.

## Every verb, delivered through one door and fired the same night

The same door, `POST https://ops.miscsubjects.com/api/text`, now takes an `action` field, and every action below was fired on 2026-09-21 against the build's own Blooio line from the owner's Apple ID, or from the rented line to the owner's phone, with the row it produced in the Mac's message store or Blooio's reply as the evidence.

| action | from the owner's own Apple ID | from a rented line | evidence |
|---|---|---|---|
| send | yes, alias steered | yes, exact sender | rows 679715, 679716 |
| image, video, file by url | yes, alias steered | yes, as an attachment | rows 679731, 679749 (`public.png`); Blooio message msg_01a0c7b8-8984 |
| audio (voice note from a url, or spoken from text) | yes; the audio is dropped when the chat's alias had to be switched first, and the reply says `attached: false` | yes, as an attachment | row 679762 (`com.apple.m4a-audio`); rows 679747, 679751, 679765, 679769 dropped after a switch |
| contact card | yes, a `.vcf` that lands as a tappable contact | yes, the line's name and photo | row 679734 (`public.vcard`); Blooio `shared: true` |
| react (tapback) | yes, on the chat's latest message | yes, on a named message | row 679736 (type 2000, love); Blooio `+love` on msg_01a0c7a0 |
| delivery (sent, delivered, read, when) | yes, read from the store | yes, Blooio status | row 679716 delivered 05:48:33 |
| group (text or file into an existing group) | yes, by group name or id | yes, by chat id | the verb is the one that sent to a three-person group on 2026-09-11 |
| poll | needs the private API | yes | Blooio msg_01a0c7b8-3c8a; the owner's votes arrived as rows 679724 and 679725 (types 4000 and 4001) |
| typing, read receipt | needs the private API | yes | Blooio `state: started`, `read: true` |
| chats, groups, history, search, inbox, unread | yes | chats, history | search returned the alias-test rows; groups listed 2782, 2778, 2775 |
| contacts search, create, update, delete | yes, the Mac's Contacts app, synced to the phone | Blooio contacts rows exist | created and deleted "Build Test Contact" (id 9BDD4AD9) |
| webhook (every inbound and outbound message POSTed to a url, signed) | yes, from the watcher, HMAC over the raw body with the build key | yes, Blooio's own signed webhook | set with one call; the watcher writes `webhook.log` |
| edit, unsend, effects, location, FaceTime | needs the private API | Blooio: none of these either, except FaceTime on request | the v2 and v4 specifications |

Reading the signal, not the manual, decided three of these. A Blooio poll arrives in the store as a balloon message with bundle id `com.apple.messages.MSMessageExtensionBalloonPlugin:0000000000:com.apple.messages.Polls` and a 4,637-byte payload, and a vote leaves as a message of associated type 4000 or 4001; a tapback is associated type 2000 to 2005 on the target's guid; a typing indicator and a name-and-photo share write no row at all. Polls, tapbacks by id and typing therefore need the private API on the owner's identity, because only it can write balloon payloads and associated messages; a picture, a card and an audio file are attachments, which the owner's identity sends today.

## Verdict, and what would change it

The build can offer Blooio's feature suite as an orchestrator on top of Blooio's lines and cannot offer it as an independent provider, because the independent provider's product is the device fleet, and building a fleet is the whole business of the four vendors. The three extras the question named are the build's existing shape, not new work. Of the twelve gaps first counted, three are ledger reads and rows already held, four are packaging, and five carry a physical or Apple-imposed constraint; number supply and the awake Messages session are the two a first paying customer meets in the first hour.

Two facts would change the verdict. If Blooio refuses the Number Purchase API access request, door two collapses to the two lines the build already rents and a manual dashboard purchase per customer, and the resale margin becomes the difference between a manual line and a customer's willingness to pay for the room. If the Mac executor's advanced mode is enabled on a dedicated machine and the twelve broken verbs turn green, door one becomes a fuller iMessage API than any vendor rents, because it carries the customer's own history and identity, which no rented line ever will.

## Sources

1. Blooio reference — https://miscsubjects.com/a/blooio
2. Sendblue reference — https://miscsubjects.com/a/sendblue
3. Linq reference — https://miscsubjects.com/a/linq
4. LoopMessage reference — https://miscsubjects.com/a/loopmessage
5. myCRMSIM reference — https://miscsubjects.com/a/mycrmsim
6. Native iMessage API contract (live) — https://miscsubjects.com/api/imessage
7. Directory row IMSG_SEND (live) — https://miscsubjects.com/api/directory/IMSG_SEND
8. Build sheets contract (live) — https://miscsubjects.com/api/sheets
9. Demo sheet: send a text from a cell — https://miscsubjects.com/admin/sheets?tab=sh_srsn7axk
10. Blooio vs myCRMSIM (Blooio's page) — https://blooio.com/compare/blooio-vs-mycrmsim
11. Blooio vs SendBlue (Blooio's page) — https://blooio.com/compare/blooio-vs-sendblue
12. Linq vs Blooio (Linq's page) — https://linqapp.com/s/linq-vs-blooio
13. Blooio Number Purchase API — https://docs.blooio.com/guides/number-purchase-api
14. Apple Support: If you can't turn on or sign in to iMessage or FaceTime on your iPhone — https://support.apple.com/en-us/HT201422
15. Blooio surface sheet, 246 rows — https://miscsubjects.com/admin/sheets?tab=sh_feevfx8s
16. MacStadium pricing — https://www.macstadium.com/pricing
17. Apple node contract (live) — https://miscsubjects.com/api/apple
18. Apple Support: View and remove your devices that are associated with your Apple Account for purchases — https://support.apple.com/en-us/HT204074
19. Apple Support: Using Dual SIM with an eSIM — https://support.apple.com/en-us/HT209044


---

# Blooio: a cloud iMessage, RCS and SMS API on rented Apple devices, and the limits that govern every send

slug: blooio · https://miscsubjects.com/a/blooio · category: reference · tags: imessage, messaging-api, blooio, vendor-reference · updated 2026-09-22T05:09:26.614Z

Blooio is a cloud service that sends and receives iMessage, RCS and SMS from a REST API, on Apple devices that Blooio owns and runs. A customer never touches a Mac or an iPhone: the customer rents a phone number, calls an HTTP endpoint, and Blooio's device fleet does the sending. Blooio's own description, read on 2026-09-21, is "an iMessage, RCS, and SMS automation platform for businesses" that delivers "native iMessages (blue bubbles), RCS, and SMS directly from your CRM or automation platform using dedicated phone numbers". Blooio's documents carry the constraint every such service lives under: a warning that an Apple ban on a number cannot be reversed.

Three terms carry the weight of what follows. A **line** is one phone number that Blooio has registered on iMessage and rents to one customer. A **shared line** is a number from a pool that several customers use, so the sending number can differ from message to message. A **dedicated line** is a number used by one customer only.

## The two API generations

Blooio runs two API versions side by side. Version 2 lives at `https://api.blooio.com/v2/api` and addresses every message by chat: a send is `POST /chats/{chatId}/messages` with `{"text": "..."}`, where the chat id may be a URL-encoded phone number for a one-to-one chat. Version 4, marked beta, lives at `https://api.blooio.com/v4` and adds a recipient in the body: `POST /messages` with `{"to": "+15551234567", "text": "Hello!"}`, sender chosen by the key's routing rules unless a `from` string pins it. Both take one header, `Authorization: Bearer bl_live_...`.

Counted from the two OpenAPI documents on 2026-09-21: v2 publishes 40 paths and 41 schemas; v4 publishes 68 paths, 101 operations and 59 schemas. The v4 additions over v2 are channels (`/channels`, with purchase, settings and profile), priorities (ordered sender lists per key), contact identities and merge, chat participants, attachments registered ahead of a send, message templates, API-key management, an events feed, and one inference endpoint, `POST /ai/bloobability/assess`.

## What one message can carry

A message on a Blooio iMessage line can be plain text, Markdown-styled text, attachments by URL, a carousel of 2 to 20 photos or videos, a poll with two or more options, a rich link whose title and image the sender overrides, a contact card that piggybacks on the next message, a Find My or Check In bubble, a calendar invite as an `.ics` file, or a custom bubble that points at the customer's own iMessage app extension by `bundle_id` and `team_id`. Reactions are tapbacks plus emoji on macOS Sonoma and later, sent with a `+love` or `-love` style string. Typing indicators, read receipts and per-chat background images have their own endpoints. Message effects (confetti, slam, invisible ink) are absent from the v2 and v4 specifications.

A send returns 202, not 200. The message starts at `status: queued` and `protocol: pending`, then resolves to `imessage`, `rcs` or `sms` within seconds, and moves through `sent`, `delivered` and `read`. Blooio's sending guide states the rule plainly: "Messages return 202, not 200". An `Idempotency-Key` header makes a retried send return the original response for 24 hours.

## Webhooks

Every event reaches the customer as one envelope: `{id, type, created_at, organization_id, data}`, where `data` carries the whole resource. Blooio's webhook reference says "`data` carries the fully-hydrated resource, so a consumer never has to call the API back to fetch it". Four headers ride on each delivery: `X-Blooio-Event`, `X-Blooio-Delivery`, `X-Blooio-Webhook` and `X-Blooio-Signature`, the last an HMAC-SHA256 over `{timestamp}.{raw_body}` in the form `t=<timestamp>,v1=<hmac>`. Event types documented on 2026-09-21: `message.queued`, `message.sent`, `message.received`, `message.delivered`, `message.read`, `message.failed`, `message.reaction`, `poll.received`, `poll.created`, `poll.voted`, `group.name_changed`, `group.icon_changed`, plus `safety.state_changed`, `number.purchase.completed`, `number.purchase.action_required`, `number.purchase.failed` and `number.removed` on v4. A subscription receives every type; filtering happens in the receiver. Deliveries are logged, replayable by id, and the signing secret rotates by one call.

## The safety engine that decides whether a send goes out

Blooio does not let a line send freely. Its messaging-safety guide opens with the reason: "Blooio applies safety limits to protect iMessage numbers from patterns that Apple may treat as automated or unwanted messaging." Two independent systems apply.

Conversation limits are per recipient. A new chat may receive 3 plain-text messages before the recipient answers; a reaction moves it to Acknowledged (3 per response); one written reply moves it to Active (4); three replies across two UTC days to Established (6); ten replies across three days in a thread at least seven days old to Trusted (8); fourteen silent days to Inactive (one re-engagement message). Links and attachments are unlocked only by a written reply. Blocked sends return 429 with a stable `code` such as `conversation_awaiting_reply`, and the guide says a retry timer will not clear them.

Number protections are per sending line and graduated: `queue` (bursts of up to 8, then a 3 to 8 second wait), `slow` (30 to 60 seconds), `pause_new` (no new chats), `reply_only`, and `review` (all sending stopped). The `one_way` reason fires when a line averages more than 10 new chats a day over three days, has at least 10 new chats in the trailing week, and fewer than 40% of them earned a written reply; `template` fires when at least half of 10 or more first touches in a week reuse one opener; `delivery` fires when the iMessage share drops more than 10 points or device-visible failures double against the 72-hour baseline; `sibling_ban` slows every other line for 72 hours after one line on the account is banned. Administrators may switch the limits off for a dedicated line; the guide labels that an exception that "materially increases the risk of an unrecoverable Apple ban".

## Numbers, plans and the purchase API

Prices published at blooio.com/pricing on 2026-09-21: Free Trial at $0 for 20 messages across 2 conversations; Starter at $39 a month on a shared line with 5 new contacts a day; Commercial Shared at $89 with 15 a day; Commercial Dedicated at $289 per line with no new-conversation cap; Inbound at $109 for a dedicated reply-only line that "cannot initiate new conversations"; Enterprise Dedicated from $389 for one line down to $195 per line at six or more. A custom area code costs $75 once. The pricing document's own summary: "All plans include full REST API access, unlimited team members, webhooks, native CRM integrations, an MCP server for AI agents, and no per-message fees." Voice calling, FaceTime on request, and call forwarding sit on the two dedicated plans.

Lines can be bought from code. The v4 Number Purchase API guide states: "The Number Purchase API lets you provision Blooio lines from your own code instead of clicking through the dashboard." Three gates precede the first purchase: organization identity verification through Stripe Identity, a staff-approved access request, and a card on file. `GET /channels/blooio/available?type=dedicated` returns masked inventory such as `(801) ***-****`; `POST /channels/blooio/purchases` with a required `Idempotency-Key` and a plan id (`shared_nc`, `shared_com`, `dedicated_com`, `dedicated_ent`, `inbound_basic`) returns 202 and a `purchase_id`; provisioning completes asynchronously and fires `number.purchase.completed`. A single order is capped at 10 lines by default, and a shared plan is capped at one line per organization. The same guide names resellers as an intended user: platforms that "provision a fresh number for each of their end customers".

## Routing across channels

A v4 API key owns channels: Blooio numbers, Twilio numbers imported with the customer's own Twilio account, WhatsApp Business sessions and RCS Business agents. A **priority** is an ordered list of those channels; entries on the same tier of the same type form a sticky pool, and lower tiers are fallbacks. Hybrid mode sends a cold first message on a Twilio SMS number and, after the contact replies, continues on a Blooio iMessage number with an optional transition sentence. SMS fallback for recipients without iMessage routes through the customer's Twilio sub-account, so A2P 10DLC registration stays where the customer already holds it.

## Developer surface

Beyond REST, Blooio publishes: a hosted Model Context Protocol server at `https://mcp.blooio.com/v4` exposing 61 tools on 2026-09-21 (from `me` and `send_message` to `replay_webhook_delivery` and `get_location_contact`), authenticated by the same API key as a bearer token or by OAuth; SDKs for Node, Python, Java and Go; an OAuth "Log in with Blooio" flow for third-party apps with scoped tokens, under which an app holding `apikeys:manage` can mint API keys for a customer organization and assign channels to them; `llms.txt`, `llms-full.txt` and `pricing.md` for machine readers; and native connectors for GoHighLevel, n8n, Make, Zapier, IFTTT, HubSpot, Clay and Whop.

## Inference

Bloobability v1.0.0, released 2026-09-02, is a pair of task heads on one 3.98-billion-parameter model built from Nemotron-3-Nano-4B. A caller sends a conversation plus named policies in plain language; the matcher returns which policies apply and which message ids support each, and the gauge returns a calibrated probability per policy. Blooio reports a matcher micro F1 of 0.9893 and a gauge median per-policy AUC of 0.8737 on held-out data.

## Claims Blooio makes about itself

Blooio's marketing figures, each carrying its own window: about 99% delivery across 4.2 million or more outbound iMessages and 310 or more active accounts, January to March 2026; roughly 2x the reply rate of SMS across 1,800 or more campaigns and 2.6 million messages, November 2025 to February 2026; a 99.9% uptime target with a contractual commitment only under a signed Enterprise order form; "SOC 2–aligned" controls rather than a published certification. Two absences are worth stating because the specifications, not the marketing, settle them: neither v2 nor v4 publishes a message-editing or unsend endpoint, and neither publishes a message-effect field. Whether a send lands as a blue bubble is decided by the recipient's device, and the `protocol` value on the message is the only place the answer appears.

## Sources

1. Blooio llms.txt (authoritative source notice) — https://blooio.com/llms.txt
2. Blooio API v2 index for machine readers — https://docs.blooio.com/llms.txt
3. Migrating from v2 to v4 — https://docs.blooio.com/migrating-to-v4
4. Blooio Pricing (markdown source of the pricing page) — https://blooio.com/pricing.md
5. Messaging safety limits and recovery — https://docs.blooio.com/guides/messaging-safety
6. Number Purchase API — https://docs.blooio.com/guides/number-purchase-api
7. Blooio MCP server card — https://blooio.com/.well-known/mcp/server-card.json
8. Blooio full context export, Webhook Events — https://blooio.com/llms-full.txt