Mitto
MessagingConnect AI agents to Mitto, a Swiss enterprise CPaaS for A2P SMS, one-time passwords, and number lookup. Agents send single and bulk SMS, deliver and verify OTP codes, and look up numbers via HLR so customer notifications and verification steps run inside governed workflows.
What This Integration Enables
Mitto is a Swiss enterprise CPaaS operated by Mitto AG in Zug, and this connector covers three of its published APIs: SMS and bulk SMS, two factor authentication including the voice channel, and HLR number lookup. Count the actions and the product's real center of gravity is obvious. Four of the twenty four send or account for SMS. Two look numbers up. The other eighteen are one time passcodes: issuing, verifying, canceling, auditing, and, most interestingly, governing. That is not an SMS gateway with a verification feature bolted on. It is verification infrastructure that also sends SMS.
The part worth choosing this platform for is the governance layer, because almost every CPaaS makes you build it yourself. Mitto exposes named rate limits, each carrying up to two throttling buckets, so a policy such as one code per sixty seconds and ten per twenty four hours exists as an object with a name rather than as a counter in somebody's Redis. It exposes named workflows, escalation sequences of up to five steps across SMS and voice, each with a minimum wait, stopping the moment the code verifies. Send OTP takes those by name. That means a verification policy is inspectable, versionable, and changeable without touching the applications that depend on it, and it means an agent can read the current policy rather than infer it.
Two facts shape how you build against Mitto and both are worth stating plainly. Account setup is not self serve: Mitto onboards through its contact form and issues credentials afterward, and the addresses making API requests must be allowlisted on Mitto's side for all three APIs. And there are no triggers, because Mitto delivers delivery receipts and inbound messages as callbacks to a URL a Mitto account manager configures for your account, with no subscription API to create or delete them. Get OTP Session, Search OTP Sessions, and Get SMS Usage By Country are the supported way to see what happened, and they are unusually detailed reads, which makes polling a reasonable design here rather than a consolation prize.
Without FlowRunner
With FlowRunner
Use Case Scenarios
Verification that escalates instead of repeating
A financial services team sends a passcode at login. Rather than sending the same SMS three times to a handset that is switched off, the flow names an OTP workflow: SMS first, then after a wait, a text to speech voice call in the user's language, then a second voice attempt. The sequence stops the instant the code verifies, so a user who reads the first message never receives a call. The agent keeps the request identifier from Send OTP, and when the user submits a code, Verify OTP settles it. When the user abandons the screen, Cancel OTP invalidates the code immediately rather than leaving a live credential in circulation for its full validity window. Every outcome lands in the case record in Auth0 alongside the session identifier, so a later dispute has something to read.
Deciding whether the number is worth sending to
Before a code goes anywhere, Look Up Number runs a live HLR lookup and returns the network, the country, the porting status, the roaming status, and an absent flag indicating the handset is not currently reachable. That last field is the useful one. An absent handset is a reason to reach for the voice channel or email rather than to send an SMS that will sit in a queue past the code's validity. For a bulk onboarding import, Look Up Multiple Numbers does the same across a list, and the agent uses the results to split the file: reachable mobiles proceed, landlines route to voice, and numbers whose country does not match the account record become an automation exception in Slack. Number lookup is billed per number including in batch mode, so the flow treats the lookup itself as a spend and states the count before running it.
Reconciling verification cost against verification value
Get OTP Usage aggregates counts filtered by channel, recipient, status, verification outcome, and time range, and Get OTP Usage By Period buckets the same data by day, month, or year. Get SMS Usage By Country returns message counts and cost per destination country for a date range, with a thirty one day maximum per query. Monthly, the agent assembles all three into a single view in PostgreSQL: codes issued, codes verified, and cost by country. The ratio of issued to verified is the number that matters, because a country where codes are issued constantly and verified rarely is either a country with a routing problem or a country being farmed, and both need a person to look.
Human-in-Loop Highlight
The gate on Mitto is any change to a named OTP limit or workflow, and it exists because those objects are referenced by name from live sending code, while the API offers no way to find out who is referencing them. Send OTP takes a limit name and a workflow name as strings. Delete OTP Limit removes the throttle that stands between your account and passcode pumping on a premium destination. Delete OTP Workflow removes an escalation sequence that some application, somewhere, is still naming on every login. Neither deletion costs anything at the moment it runs, and neither returns a warning, which is precisely what makes them worth stopping for. The bill arrives days later on a route nobody was watching, or the failure arrives as users who cannot get into their accounts because the workflow their sign in flow names no longer exists.
So an agent that maintains verification policy gathers the evidence and then stops. It reads List OTP Limits and Get OTP Limit for the current buckets, reads Get OTP Usage filtered to the affected recipients for the traffic those buckets have actually been absorbing, and puts both in front of the person who owns fraud. Into Slack: "Change requested to limit signup_otp: from one per 60 seconds and ten per 24 hours, to one per 15 seconds and fifty per 24 hours. Last thirty days under the current limit: 41,900 codes issued, 38,120 verified. Three recipients hit the daily bucket. This limit is named by any flow that passes signup_otp, and Mitto exposes no way to list those callers. Approve, or approve with a lower daily bucket?" That is a judgment about fraud tolerance, which belongs to a person, and it is being asked with the numbers already assembled.
That is human-in-the-loop placed where the consequence is delayed rather than immediate, which is the harder case and the one automation usually gets wrong. Notice what stays autonomous. Sending a code, verifying a code, and canceling a code when a user walks away all run without asking, because they are the work and because Mitto's own limits are the control on them. Cancel OTP in particular should be aggressive and unattended, since an abandoned session leaving a live credential in circulation is a worse outcome than an extra invalidation. The judgment being escalated is not whether to verify somebody. It is whether to weaken the control that decides how often anybody can be.
Agent Capabilities
24 actionsSMS
4- Send SMS Sends one message to a single recipient in international format, with control over encoding, validity, flash mode, a metadata reference, a per request callback URL override, and a test mode that validates the request without dispatching it. That test mode is the closest thing this API has to a dry run.
- Send Bulk SMS Sends the same body to a list of recipients in one request. Each recipient is billed separately and receives its own message identifier, so reconciliation stays per person rather than per batch.
- Track SMS Conversion Marks a sent message as converted so Mitto can factor the outcome into future routing decisions. The feedback loop that lets the platform learn which routes actually deliver for your traffic.
- Get SMS Usage By Country Returns message counts and cost per destination country for a date range, with a thirty one day maximum per query. The cost read behind any monthly reconciliation.
Number Lookup
2- Look Up Number Runs a live HLR lookup for one number, returning the network, country, porting status, roaming status, absent flag, and the cost of the lookup itself. The absent flag is the field worth branching on, because it says the handset will not receive anything right now.
- Look Up Multiple Numbers Runs the same lookup across a list in one request. Every number in the list is a separate chargeable lookup, so treat a batch lookup as a spend rather than as a free read.
One-Time Passwords
4- Send OTP Issues a code, substitutes it into your message body, and delivers it over SMS, a text to speech voice call, or email. Supports code length, validity timeout, guard time, voice language and repeat count, and a named limit or workflow to govern it.
- Verify OTP Checks a code the user entered against the session. The settlement of a verification, and the point at which an escalation workflow stops.
- Cancel OTP Invalidates an issued code so it can no longer be verified. Worth running unattended the moment a user abandons a flow, since a live credential with time left on it is the thing you least want lying around.
- Get OTP Session Returns the full session detail record for one request identifier, including every verification attempt and every delivery event. The record a support conversation should be answered from.
OTP Reporting
4- Search OTP Sessions Runs a filtered, paginated search across session detail records. The read behind any investigation that starts with a recipient or a time window rather than with a known request identifier.
- List OTP Sessions Returns the same session data with control over sort field and direction. Used when the question is about ordering, such as the most recent failures first.
- Get OTP Usage Returns aggregated counts filtered by channel, recipient, status, verification outcome, and time range. The ratio of issued to verified is the number this action exists to produce.
- Get OTP Usage By Period Returns the same counts grouped into daily, monthly, yearly, or relative buckets such as today, yesterday, this month, and last month. The shape a recurring report wants.
OTP Limits
5- Create OTP Limit Creates a named rate limit with up to two throttling buckets, for example one code per sixty seconds and ten per twenty four hours. Send OTP enforces it by name.
- Update OTP Limit Changes an existing limit's buckets. A change here alters the control on every flow that names this limit, and none of those callers are discoverable through the API.
- Delete OTP Limit Removes a named limit. The throttle it enforced disappears immediately, and nothing that references the name is warned.
- List OTP Limits Returns every named limit on the account. The read that establishes what the current policy actually is, as opposed to what it was documented as.
- Get OTP Limit Returns one named limit with its buckets. Used to show the current state alongside a proposed change.
OTP Workflows
5- Create OTP Workflow Creates a named escalation sequence of up to five steps across SMS and voice, each with a minimum wait, stopping as soon as the code verifies. This is how a retry becomes a strategy instead of a loop.
- Update OTP Workflow Changes an existing sequence. Live sends naming this workflow pick up the new behavior on their next call.
- Delete OTP Workflow Removes a named sequence. Any send that still names it fails, and Send OTP has no way to validate the name in advance.
- List OTP Workflows Returns every named workflow on the account, which is the inventory a policy review starts from.
- Get OTP Workflow Returns one workflow with its steps and waits. The read to put beside a proposed change so a person can see what is being replaced.
Frequently Asked Questions
What can FlowRunner do with Mitto?
FlowRunner agents can run Send SMS, Send Bulk SMS, and Track SMS Conversion in Mitto, plus 21 more actions.
Does connecting Mitto to FlowRunner require OAuth?
No. Mitto connects to FlowRunner with an API key, no OAuth flow required.
Can Mitto trigger a FlowRunner workflow automatically?
Mitto doesn't currently expose triggers in FlowRunner. It connects as an action step inside workflows started by another trigger.
Start building with Mitto
$100 in credits. No card required. Connect in minutes.