Product changelog and announcements

In an ongoing effort to raise awareness of the risk of SMS Traffic Pumping fraud, Twilio has added a popup asking customers to acknowledge the risk when opting to send SMS traffic to countries Twilio has identified a rise of SMS Traffic Pumping Fraud. Twilio will update this list from time to time.

What do I need to do?

We recommend review of the current geo-permissions on your account in Console.

(Support Article) Please take the following steps to protect your account from SMS Traffic Pumping Fraud:

1. Log in to your Twilio Account and verify the traffic history on your account is legitimate in Messaging Insights.
2. Take steps to protect your applications from abuse by following best practices in this SMS Traffic Pumping article, including turning off geo permissions for countries when not in use.

In order to provide additional information and transparancy around delivery timing we are adding a new parameter (RawDlrDoneDate) to Delivered and Undelivered status update webhooks for MMS and SMS messages. This parameter is a passthrough of the Done Date included on the DLR (Delivery Receipt) that we receive from our carrier partners. It takes the format of YYMMDDhhmm where:

YY = last two digits of the year (00-99)

MM = month (01-12)

DD = day (01-31)

hh = hour (00-23)

mm = minute (00-59)

Important notes on this data:

The format only includes minute level precision.

• The format does not provide timezone information. In practice, the timezone offset varies between carrier partners and even within the same carrier.
• Because of SMS/MMS signaling intricacies, not all messages will receive a RawDlrDoneDate in the Delivered or Undelivered status. Not all carrier partners offer DLRs and some messages go undelivered before a DLR is available.
• This parameter will also be added to Event Streams in the near future. Integrating with the parameter in event streams will require upgrading to a new schema version.
• The feature will be rolled out gradually. We expect the vast majority of Delivered/Undelivered messages to include the data by the end of February 2023.

It is strongly recommended that you use a Twilio provided signature validation library to verify the provenance of all webhooks arriving at your servers. The specific ordering and parameters included with each webhook depend on a number of factors and will evolve over time; thus it is important to follow the full specification of signature validation. This is already fully implemented and tested in the Twilio provided SDKs.

On Thursday, January 12th, 2023 at 9:00am PST, Twilio’s request to the webhook URL configured for a phone number will no longer contain the ReferralNumMedia property for SMS and MMS messages. This parameter is only relevant for WhatsApp messages generated from Meta’s “Click-to-WhatsApp” ads. It was previously incorrectly added to all messages, but will only be returned on WhatsApp messages going forward.

Twilio recommends that customers validate Twilio’s requests to their webhook URL by following this guide, making sure to pass all parameters sent to the webhook URL without filtering to the validateRequest call. Twilio strongly discourages validating based on the presence (or absence) of certain parameters.

Update: This is now completed. SMS and MMS messages will no longer have the ReferralNumMedia property sent to the SMS Webhook URL.

The change we announced in March 2022 to API response headers for all SMS and MMS messages sent via Twilio’s Messaging APIs has been canceled. The updates to our terms and policies, which were jointly announced with the potential pending content verification API response header change, are unaffected by this announcement and remain in effect.

Twilio continues to strive for high message deliverability and to keep consumers safe. Thank you for doing your part in promoting trusted communications by ensuring your compliance with Twilio’s Acceptable Use Policy and Messaging Policy and securing proper consent from senders and recipients before messages are sent.

Twilio has released changes to the US A2P 10DLC Campaign creation process in the Twilio API and Twilio Console to reflect the latest ecosystem guidelines. These changes include collection of new fields regarding user consent (e.g., opt-out keywords and auto-reply messages), as well as enforcement of length requirements to existing and new fields. Please read more about this change from the Twilio support article, and check out code samples and API guidelines from Twilio docs.

Twilio now supports new error codes for "Rejected" and "Paused" WhatsApp Templates. With Twilio Alarms, you can now get notified via webhook or email when these and other errors occur.

When a WhatsApp template gets rejected, Twilio surfaces a new error code of 63040 and will include the reason from WhatsApp.

Likewise, if a WhatsApp template is paused due to quality concerns from WhatsApp, Twilio will surface an error code of 63041. The message also contains when it will be unpaused. A template can be paused by WhatsApp when different users report messages sent using that template, or when users block the number after receiving those messages.

Effective today (October 24, 2022), Twilio is ending the sale of Notify. New customers will be unable to use the product.

We intend to end of life (deprecate) the Notify product on October 23, 2023. Existing customers will be supported up until this date, however, no new feature enhancements or rate limit increase requests will be granted.

Other Twilio products that support push notification use cases such as Verify or Conversations are not impacted by this.

We are sincerely sorry for any disruption this may cause and have prepared this Migration Guide to assist with the transition.

We are excited to introduce the new Messaging - Regulatory Compliance section in the Twilio Console! Regulatory Compliance consists of the following screens, which provide enhanced experience to Twilio's US A2P 10DLC customers.

A2P 10DLC Messaging customers with a Tax ID (for example, EIN in the US) can now register a Low Volume Standard Brand in Twilio Console - Trust Hub - A2P Messaging

Twilio has deprecated the ability to register new Starter Brands due to updated registration requirements from The Campaign Registry (TCR). As a result, the option to create or update Starter Profiles or Brands is disabled in the Twilio Console and APIs. API requests to create or update Starter Profiles will fail with error code 22404; API requests to create or update Starter Brands will fail with error code 21726.

Previously registered Starter Brands and Campaigns are subject to new data validation requirements. Any campaigns and brands that do not meet those requirements will be deleted by Twilio on behalf of customers starting Nov 3rd.

Customers with Tax IDs are requested to register for A2P 10DLC using the Low Volume Standard Brand or Standard Brands options.

For more information, please check out our recent blog post which explains the process for new registrations and the criteria for keeping existing registrations.