SMS & messages

SMS spam filter

API · Pro2026-10-28

Coverage: iOS / Android

On this page

Purpose

On iPhone, enable NoCall as the SMS filter in the system Messages settings and review filtered messages there. The extension does not filter iMessage. On Android, the analyzer checks text you share: it does not automatically read the inbox or change SMS delivery. The website does not enable the phone filter.

Requirements

Tool plan: Free / Pro

Anyone can read these guides, no account needed. Some tools require Pro, as indicated in each guide.

How to use it

Download App
On iPhone, open SMS activation in NoCall and follow the Settings steps to select the filter. On Android, paste a message into the manual analyzer. Review rules and synchronization in the app.
On iPhone, enable NoCall as the SMS filter in the system Messages settings and review filtered messages there. The extension does not filter iMessage. On Android, the analyzer checks text you share: it does not automatically read the inbox or change SMS delivery. The website does not enable the phone filter.

Synthetic example

Invented example, not a real lookup. Do not call or open its links.

DHL: Last warning. Your parcel is blocked. Action required at https://parcel.example

Interpret the result

It shows some scam signs. Don’t open the link; check directly on the official website or app.

Limitations

Indicative result based on automatic signals, not sender verification. No result guarantees that a message is safe.

Troubleshooting

On iPhone, open SMS activation in NoCall and follow the Settings steps to select the filter. On Android, paste a message into the manual analyzer. Review rules and synchronization in the app.

Use with the API

Needs an API key and credits. Each completed call costs 1 credit, even when there is no data. An active Pro account includes 20 credits per UTC calendar month, shared by every API route and spent first; unused monthly credits do not roll over. Credits bought on your account page work without Pro and never expire.

Errors are never charged: 401 invalid_api_key (missing or invalid key), 403 pro_required (no Pro credits and no purchased credits), 422 invalid input, 429 quota_exceeded (no credits left), rate_limit_exceeded or ai_busy (the AI of sms-check is at capacity), 503 tool_warming (the data is still being prepared) or tool or provider unavailable. After a 429 or 503, retry once the seconds in the Retry-After header have passed.

Version, source and rule counts of the country's "Base NoCall" SMS filter rules. Counts only, never the lists.

Send the JSON body to the tool's own route, or to POST /v2/tools with the tool field added. Both routes return the same result.

POST https://api.nocall.io/v2/sms-filter
POST https://api.nocall.io/v2/tools  {"tool":"sms-filter","country":"ES"}

Parameters

Name	Type	Required	Description
country	string (enum, 55)	No (default: "ES")	Country whose SMS rule set is used.

REQUEST_ID="$(uuidgen)" && [ -n "$REQUEST_ID" ] &&
curl --request POST 'https://api.nocall.io/v2/sms-filter' \
  --header "Authorization: Bearer $NOCALL_API_KEY" \
  --header 'Content-Type: application/json' \
  --header "Idempotency-Key: $REQUEST_ID" \
  --data '{"country":"ES"}'

import json
import os
import urllib.request
import uuid

api_key = os.environ.get('NOCALL_API_KEY')
if not api_key:
    raise SystemExit('Set NOCALL_API_KEY')

request = urllib.request.Request(
    'https://api.nocall.io/v2/sms-filter',
    method='POST',
    data=json.dumps({'country': 'ES'}).encode(),
    headers={
        'Authorization': 'Bearer ' + api_key,
        'Content-Type': 'application/json',
        'Idempotency-Key': str(uuid.uuid4()),
    },
)
with urllib.request.urlopen(request, timeout=30) as response:
    result = json.load(response)
print(result['data']['result'], result['meta']['unitsCharged'])

import { randomUUID } from 'node:crypto';

const requestId = randomUUID();
const apiKey = process.env.NOCALL_API_KEY;
if (!apiKey) throw new Error('Set NOCALL_API_KEY');

const response = await fetch('https://api.nocall.io/v2/sms-filter', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer ' + apiKey,
    'Content-Type': 'application/json',
    'Idempotency-Key': requestId,
  },
  body: JSON.stringify({ country: 'ES' }),
});
const result = await response.json();
if (!response.ok) throw new Error(result.error?.code ?? 'request_failed');
console.log(result.data.result, result.meta.unitsCharged);

Example response (200)

This is the documented example from the API reference. Lookups use a fictional number, and aggregates and AI answers show the shape of the result, not live data.

{
  "data": {
    "tool": "sms-filter",
    "result": {
      "country": "ES",
      "version": "2026-03-10",
      "updatedAt": "2026-03-10T00:00:00.000Z",
      "source": "default",
      "counts": {
        "riskKeywords": 27,
        "brandKeywords": 13,
        "trustedDomains": 20,
        "shortenerDomains": 10,
        "blockedKeywords": 0
      }
    }
  },
  "meta": {
    "requestId": "req_example",
    "unitsCharged": 1,
    "usage": {
      "periodStart": "2026-10-01",
      "unitLimit": 20,
      "unitsUsed": 3,
      "unitsRemaining": 17
    }
  }
}

Result fields (data.result)

Field	Type	Description
country	string	Country of the rule set.
version	string	Version of the rule set.
updatedAt	string \| null	When the rules were last updated, or null.
source	"database" \| "legacy_default" \| "default" \| "empty"	Where the rules come from.
counts	object	Number of rules in each list. The lists themselves are never returned.

API reference