curl http://phabulous-test.clearspring.local/api/harbormaster.sendmessage -d api.token=api-g7at5gpj6v6tcsafbgl6qlpclcru -d buildTargetPHID="PHID-HMBT-jim2c2o4p7nj62pgc5vf" -d type="success"
{"result":null,"error_code":null,"error_info":null}(The valid type of course is 'pass'.)
We currently allow any message, we just don't do anything with messages we don't understand. Possibly this should be made more strict, but I imagine accepting any message and possibly letting extensions handle them in the future. We might not be able to figure out if anything will accept a message or not when we receive it.
harbormaster.sendmessage now explicitly documents which messages it is prepared to receive:
https://secure.phabricator.com/conduit/method/harbormaster.sendmessage/
That might not be good enough, but I'd like to see a little more confusion about this post-documentation before locking it down. It's probably correct to lock it down, but limits the design space for messages a little bit.