this api should not even be exposed! it's supposed to be called by a backend module! ..

to send notification they can just use something like big ip f5 to whitelist only allowed IP address could access the endpoints. infact just build the service separate and segregation between internal and external network.

client side to trigger? it don't work that way. the service i work on sents millions of sms daily. we are the one triggering to an end point expose by the provider. mysejahtera would have the list of contact on their end. all they need to do is periodically send the sms via to end point expose by the few operator we have.

if it's really trigger by us who has mysejahtera that's stupid

the way u put it there is somethg so wrong in term of the app design. the request should trigger a notification and queue the request somewhere instead of client calling the service immediately. anyway 0 marks to the application design in this case