Whatever an active prefix callback URL returns in the HTTP body is sent back as the SMS reply, trimmed to 512 characters. An empty callback body sends no callback reply.
The first word is used only to look for an active configured prefix. If no active prefix matches and AI personal replies are enabled by an administrator, the complete SMS is evaluated as ordinary natural-language text. A normal message such as Hello, are you there? is not treated as a malformed command merely because its first word is not registered as a prefix.
An active known prefix always keeps precedence. If it exists without a callback URL, it does not fall through to AI.
Concurrent deliveries of the same inbound webhook are serialized around the existing hash duplicate check so gateway retries cannot race each other into multiple callback or AI replies.
The callback URL owner should return a clean, user-friendly body. JSON and other callback bodies are sent as returned; Tools does not reinterpret them.