rcs 2.0.14 → 2.0.16.pre.rc.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 362ad9ba7c8c47a7e24f2e98ae2b6a4af84b43e66faaa0682622414565a8f5de
-  data.tar.gz: eb18c0b9268ce71ae35a20a2b6a8a68409f80637fa495faac8a93a541f59bd3b
+  metadata.gz: d2cac8fd3c68928a102bb892cd100493eb70f36a326b1c0eff8d80e9e09654a4
+  data.tar.gz: 702ed3fc0bcafd3836774adcca8cf3f8feb54bcb6120b13c1c9523a5836d5550
 SHA512:
-  metadata.gz: af1d17f92bbd2f7e9835f1b9360dc4bb93d5b88140951da73ef943bcc83b38cc2189d7e914dee005bf61101cf17feb643814bd7695acd41d20ce996e1af47a9b
-  data.tar.gz: c89f1854e0650dfcb4a01a46c88f4016007550e8c3d642f4578e1835cc3b744c0cc61cb6e662625e6e2e9a562c3d41a95d0934c26dacce2ac535e6fd583d2749
+  metadata.gz: fbeabb07e1998a0f02d5cf7b02faf556e7d2595089daaf0e9f1c4be52a20eb20e130e7b631fb4ed2892fb3beddac5b07f84ddc8b11f782afbcbbd7f85adb0b80
+  data.tar.gz: 1db2d564b8c37db520453732791d53875eff850db2bc8cf1dd5350805f696f3e482eb344d3724a434bc590903f1b49d32e937faa275d87b9239467d34071836b

data/.fern/metadata.json

@@ -1,11 +1,12 @@
 {
-  "cliVersion": "3.51.3",
+  "cliVersion": "4.58.0",
   "generatorName": "fernapi/fern-ruby-sdk",
-  "generatorVersion": "1.0.0-rc84",
+  "generatorVersion": "1.1.13",
   "generatorConfig": {
     "clientModuleName": "PinnacleBaseClient",
     "flattenModuleStructure": true,
     "useProvidedDefaults": true
   },
-  "sdkVersion": "2.0.14"
+  "originGitCommit": "fb028ee5e2c6395c9680eb66d1173e55015384c0",
+  "sdkVersion": "2.0.16.pre.rc.1"
 }

data/.rubocop.yml

@@ -45,7 +45,11 @@ Layout/LineLength:
   Enabled: false
 
 Naming/VariableNumber:
-  EnforcedStyle: snake_case
+  # Fern's ruby-sdk generator emits symbols like :gsm_7 / :utf_16 / :code_3
+  # (snake_case) in generated type classes while shipping a template that
+  # enforces `normalcase`. The two are inconsistent, so disable the cop
+  # until the generator resolves it upstream.
+  Enabled: false
 
 Style/Documentation:
   Enabled: false
@@ -58,3 +62,12 @@ Minitest/MultipleAssertions:
 
 Minitest/UselessAssertion:
   Enabled: false
+
+# Dynamic snippets are code samples for documentation, not standalone Ruby files.
+Style/FrozenStringLiteralComment:
+  Exclude:
+    - "dynamic-snippets/**/*"
+
+Layout/FirstHashElementIndentation:
+  Exclude:
+    - "dynamic-snippets/**/*"

data/lib/pinnacle/brands/client.rb

@@ -108,7 +108,7 @@ module Pinnacle
         request = Pinnacle::Internal::JSON::Request.new(
           base_url: request_options[:base_url],
           method: "GET",
-          path: "brands/#{params[:id]}",
+          path: "brands/#{URI.encode_uri_component(params[:id].to_s)}",
           query: query_params,
           request_options: request_options
         )
@@ -143,7 +143,7 @@ module Pinnacle
         request = Pinnacle::Internal::JSON::Request.new(
           base_url: request_options[:base_url],
           method: "POST",
-          path: "brands/#{params[:brand_id]}/submit",
+          path: "brands/#{URI.encode_uri_component(params[:brand_id].to_s)}/submit",
           request_options: request_options
         )
         begin
@@ -216,7 +216,7 @@ module Pinnacle
         request = Pinnacle::Internal::JSON::Request.new(
           base_url: request_options[:base_url],
           method: "POST",
-          path: "brands/#{params[:brand_id]}/vet",
+          path: "brands/#{URI.encode_uri_component(params[:brand_id].to_s)}/vet",
           body: body,
           request_options: request_options
         )

data/lib/pinnacle/campaigns/dlc/client.rb

@@ -62,7 +62,7 @@ module Pinnacle
           request = Pinnacle::Internal::JSON::Request.new(
             base_url: request_options[:base_url],
             method: "GET",
-            path: "campaigns/dlc/#{params[:campaign_id]}",
+            path: "campaigns/dlc/#{URI.encode_uri_component(params[:campaign_id].to_s)}",
             request_options: request_options
           )
           begin
@@ -96,7 +96,7 @@ module Pinnacle
           request = Pinnacle::Internal::JSON::Request.new(
             base_url: request_options[:base_url],
             method: "POST",
-            path: "campaigns/dlc/submit/#{params[:campaign_id]}",
+            path: "campaigns/dlc/submit/#{URI.encode_uri_component(params[:campaign_id].to_s)}",
             request_options: request_options
           )
           begin

data/lib/pinnacle/campaigns/rcs/client.rb

@@ -62,7 +62,7 @@ module Pinnacle
           request = Pinnacle::Internal::JSON::Request.new(
             base_url: request_options[:base_url],
             method: "GET",
-            path: "campaigns/rcs/#{params[:campaign_id]}",
+            path: "campaigns/rcs/#{URI.encode_uri_component(params[:campaign_id].to_s)}",
             request_options: request_options
           )
           begin
@@ -96,7 +96,7 @@ module Pinnacle
           request = Pinnacle::Internal::JSON::Request.new(
             base_url: request_options[:base_url],
             method: "POST",
-            path: "campaigns/rcs/submit/#{params[:campaign_id]}",
+            path: "campaigns/rcs/submit/#{URI.encode_uri_component(params[:campaign_id].to_s)}",
             request_options: request_options
           )
           begin

data/lib/pinnacle/campaigns/rcs/types/upsert_rcs_campaign_params.rb

@@ -10,15 +10,12 @@ module Pinnacle
           field :campaign_id, -> { String }, optional: true, nullable: false, api_name: "campaignId"
           field :expected_agent_responses, -> { Internal::Types::Array[String] }, optional: true, nullable: false, api_name: "expectedAgentResponses"
           field :links, -> { Pinnacle::Campaigns::Rcs::Types::RcsLinks }, optional: true, nullable: false
-          field :use_case, -> { Pinnacle::Campaigns::Rcs::Types::RcsUseCase }, optional: true, nullable: false, api_name: "useCase"
-          field :opt_in_terms_and_conditions, -> { String }, optional: true, nullable: false, api_name: "optInTermsAndConditions"
+          field :use_case_description, -> { String }, optional: true, nullable: false, api_name: "useCaseDescription"
           field :messaging_type, -> { Pinnacle::Types::RcsMessagingTypeEnum }, optional: true, nullable: false, api_name: "messagingType"
-          field :carrier_description, -> { String }, optional: true, nullable: false, api_name: "carrierDescription"
+          field :cta_media, -> { String }, optional: true, nullable: false, api_name: "ctaMedia"
+          field :opt_in_method, -> { String }, optional: true, nullable: false, api_name: "optInMethod"
           field :keywords, -> { Pinnacle::Campaigns::Rcs::Types::RcsCampaignKeywords }, optional: true, nullable: false
           field :traffic, -> { Pinnacle::Campaigns::Rcs::Types::RcsCampaignTraffic }, optional: true, nullable: false
-          field :agent_triggers, -> { String }, optional: true, nullable: false, api_name: "agentTriggers"
-          field :interaction_description, -> { String }, optional: true, nullable: false, api_name: "interactionDescription"
-          field :is_conversational, -> { Internal::Types::Boolean }, optional: true, nullable: false, api_name: "isConversational"
           field :cta_language, -> { String }, optional: true, nullable: false, api_name: "ctaLanguage"
           field :demo_trigger, -> { String }, optional: true, nullable: false, api_name: "demoTrigger"
         end

data/lib/pinnacle/campaigns/toll_free/client.rb

@@ -62,7 +62,7 @@ module Pinnacle
           request = Pinnacle::Internal::JSON::Request.new(
             base_url: request_options[:base_url],
             method: "GET",
-            path: "campaigns/toll-free/#{params[:campaign_id]}",
+            path: "campaigns/toll-free/#{URI.encode_uri_component(params[:campaign_id].to_s)}",
             request_options: request_options
           )
           begin
@@ -96,7 +96,7 @@ module Pinnacle
           request = Pinnacle::Internal::JSON::Request.new(
             base_url: request_options[:base_url],
             method: "POST",
-            path: "campaigns/toll-free/submit/#{params[:campaign_id]}",
+            path: "campaigns/toll-free/submit/#{URI.encode_uri_component(params[:campaign_id].to_s)}",
             request_options: request_options
           )
           begin

data/lib/pinnacle/client.rb

@@ -10,7 +10,7 @@ module Pinnacle
       @raw_client = Pinnacle::Internal::Http::RawClient.new(
         base_url: base_url || Pinnacle::Environment::DEFAULT,
         headers: {
-          "User-Agent" => "rcs/2.0.14",
+          "User-Agent" => "rcs/2.0.16.pre.rc.1",
           "X-Fern-Language" => "Ruby",
           "PINNACLE-API-KEY" => api_key.to_s
         }
@@ -57,6 +57,11 @@ module Pinnacle
       @webhooks ||= Pinnacle::Webhooks::Client.new(client: @raw_client)
     end
 
+    # @return [Pinnacle::Forms::Client]
+    def forms
+      @forms ||= Pinnacle::Forms::Client.new(client: @raw_client)
+    end
+
     # @return [Pinnacle::Campaigns::Client]
     def campaigns
       @campaigns ||= Pinnacle::Campaigns::Client.new(client: @raw_client)

data/lib/pinnacle/conversations/client.rb

@@ -147,7 +147,7 @@ module Pinnacle
         request = Pinnacle::Internal::JSON::Request.new(
           base_url: request_options[:base_url],
           method: "POST",
-          path: "conversations/#{params[:id]}/messages",
+          path: "conversations/#{URI.encode_uri_component(params[:id].to_s)}/messages",
           query: query_params,
           request_options: request_options
         )

data/lib/pinnacle/forms/client.rb

@@ -0,0 +1,217 @@
+# frozen_string_literal: true
+
+module Pinnacle
+  module Forms
+    class Client
+      # @param client [Pinnacle::Internal::Http::RawClient]
+      #
+      # @return [void]
+      def initialize(client:)
+        @client = client
+      end
+
+      # Retrieve a form by id. Includes submission count, last submission timestamp, and archive state.
+      #
+      # @param request_options [Hash]
+      # @param params [Hash]
+      # @option request_options [String] :base_url
+      # @option request_options [Hash{String => Object}] :additional_headers
+      # @option request_options [Hash{String => Object}] :additional_query_parameters
+      # @option request_options [Hash{String => Object}] :additional_body_parameters
+      # @option request_options [Integer] :timeout_in_seconds
+      # @option params [String] :id
+      #
+      # @return [Pinnacle::Types::Form]
+      def get(request_options: {}, **params)
+        params = Pinnacle::Internal::Types::Utils.normalize_keys(params)
+        request = Pinnacle::Internal::JSON::Request.new(
+          base_url: request_options[:base_url],
+          method: "GET",
+          path: "forms/#{URI.encode_uri_component(params[:id].to_s)}",
+          request_options: request_options
+        )
+        begin
+          response = @client.send(request)
+        rescue Net::HTTPRequestTimeout
+          raise Pinnacle::Errors::TimeoutError
+        end
+        code = response.code.to_i
+        if code.between?(200, 299)
+          Pinnacle::Types::Form.load(response.body)
+        else
+          error_class = Pinnacle::Errors::ResponseError.subclass_for_code(code)
+          raise error_class.new(response.body, code: code)
+        end
+      end
+
+      # Partial update. Only keys present in the body are applied. Archived forms (non-null `archived_at`) cannot be
+      # updated — restore the form by setting `archived_at: null` in a PATCH first.
+      #
+      # @param request_options [Hash]
+      # @param params [Pinnacle::Forms::Types::UpdateFormParams]
+      # @option request_options [String] :base_url
+      # @option request_options [Hash{String => Object}] :additional_headers
+      # @option request_options [Hash{String => Object}] :additional_query_parameters
+      # @option request_options [Hash{String => Object}] :additional_body_parameters
+      # @option request_options [Integer] :timeout_in_seconds
+      # @option params [String] :id
+      #
+      # @return [Pinnacle::Types::Form]
+      def update(request_options: {}, **params)
+        params = Pinnacle::Internal::Types::Utils.normalize_keys(params)
+        request_data = Pinnacle::Forms::Types::UpdateFormParams.new(params).to_h
+        non_body_param_names = ["id"]
+        body = request_data.except(*non_body_param_names)
+
+        request = Pinnacle::Internal::JSON::Request.new(
+          base_url: request_options[:base_url],
+          method: "PATCH",
+          path: "forms/#{URI.encode_uri_component(params[:id].to_s)}",
+          body: body,
+          request_options: request_options
+        )
+        begin
+          response = @client.send(request)
+        rescue Net::HTTPRequestTimeout
+          raise Pinnacle::Errors::TimeoutError
+        end
+        code = response.code.to_i
+        if code.between?(200, 299)
+          Pinnacle::Types::Form.load(response.body)
+        else
+          error_class = Pinnacle::Errors::ResponseError.subclass_for_code(code)
+          raise error_class.new(response.body, code: code)
+        end
+      end
+
+      # Paginated list of forms on your team, sorted by creation date (newest first). Includes archived forms.
+      #
+      # @param request_options [Hash]
+      # @param params [Pinnacle::Forms::Types::ListFormsParams]
+      # @option request_options [String] :base_url
+      # @option request_options [Hash{String => Object}] :additional_headers
+      # @option request_options [Hash{String => Object}] :additional_query_parameters
+      # @option request_options [Hash{String => Object}] :additional_body_parameters
+      # @option request_options [Integer] :timeout_in_seconds
+      #
+      # @return [Pinnacle::Types::ListFormsResponse]
+      def list(request_options: {}, **params)
+        params = Pinnacle::Internal::Types::Utils.normalize_keys(params)
+        request = Pinnacle::Internal::JSON::Request.new(
+          base_url: request_options[:base_url],
+          method: "POST",
+          path: "forms/list",
+          body: Pinnacle::Forms::Types::ListFormsParams.new(params).to_h,
+          request_options: request_options
+        )
+        begin
+          response = @client.send(request)
+        rescue Net::HTTPRequestTimeout
+          raise Pinnacle::Errors::TimeoutError
+        end
+        code = response.code.to_i
+        if code.between?(200, 299)
+          Pinnacle::Types::ListFormsResponse.load(response.body)
+        else
+          error_class = Pinnacle::Errors::ResponseError.subclass_for_code(code)
+          raise error_class.new(response.body, code: code)
+        end
+      end
+
+      # Create a hosted form without sending it. <br>
+      #
+      # Returns the form object including its public URL — `https://forms.pinnacle.sh/{form_id}`. <br>
+      #
+      # To also deliver the URL to a recipient over SMS or RCS in a single call, use [`POST
+      # /forms/send`](/api-reference/forms/send-form).
+      #
+      # @param request_options [Hash]
+      # @param params [Pinnacle::Types::CreateFormRequest]
+      # @option request_options [String] :base_url
+      # @option request_options [Hash{String => Object}] :additional_headers
+      # @option request_options [Hash{String => Object}] :additional_query_parameters
+      # @option request_options [Hash{String => Object}] :additional_body_parameters
+      # @option request_options [Integer] :timeout_in_seconds
+      #
+      # @return [Pinnacle::Types::Form]
+      def create(request_options: {}, **params)
+        params = Pinnacle::Internal::Types::Utils.normalize_keys(params)
+        request = Pinnacle::Internal::JSON::Request.new(
+          base_url: request_options[:base_url],
+          method: "POST",
+          path: "forms",
+          body: params,
+          request_options: request_options
+        )
+        begin
+          response = @client.send(request)
+        rescue Net::HTTPRequestTimeout
+          raise Pinnacle::Errors::TimeoutError
+        end
+        code = response.code.to_i
+        if code.between?(200, 299)
+          Pinnacle::Types::Form.load(response.body)
+        else
+          error_class = Pinnacle::Errors::ResponseError.subclass_for_code(code)
+          raise error_class.new(response.body, code: code)
+        end
+      end
+
+      # Send a form to a recipient over SMS or RCS, or mint a standalone submission URL.
+      #
+      # Pass `form` as either an existing form id (`form_*`) or an inline `{ fields, ... }` definition to mint a new
+      # form for this send.
+      #
+      # The delivery channel is inferred from `from`:
+      # - `from: "agent_*"` → RCS (with optional SMS `fallback`)
+      # - `from: "+E.164"` → SMS
+      #
+      # When `to` is provided, Pinnacle dispatches a message whose body contains the submission URL and the recipient is
+      # recorded on the response: `submission.to` echoes the same E.164 number and `message_id` is the id of the
+      # outbound SMS/RCS.
+      #
+      # When `to` is omitted, no message is sent — `submission.to` and `message_id` are both `null` — which is useful
+      # for embedding the URL in your own outreach.
+      #
+      # On completion, a `FORM.SUBMISSION` webhook event is delivered to webhooks subscribed to the sender. See
+      # [Receiving Messages and User Events](/guides/messages/receiving).
+      #
+      # @param request_options [Hash]
+      # @param params [Pinnacle::Types::SendFormParams]
+      # @option request_options [String] :base_url
+      # @option request_options [Hash{String => Object}] :additional_headers
+      # @option request_options [Hash{String => Object}] :additional_query_parameters
+      # @option request_options [Hash{String => Object}] :additional_body_parameters
+      # @option request_options [Integer] :timeout_in_seconds
+      #
+      # @return [Pinnacle::Forms::Types::FormsSendResponse]
+      def send_(request_options: {}, **params)
+        params = Pinnacle::Internal::Types::Utils.normalize_keys(params)
+        request = Pinnacle::Internal::JSON::Request.new(
+          base_url: request_options[:base_url],
+          method: "POST",
+          path: "forms/send",
+          body: Pinnacle::Types::SendFormParams.new(params).to_h,
+          request_options: request_options
+        )
+        begin
+          response = @client.send(request)
+        rescue Net::HTTPRequestTimeout
+          raise Pinnacle::Errors::TimeoutError
+        end
+        code = response.code.to_i
+        if code.between?(200, 299)
+          Pinnacle::Forms::Types::FormsSendResponse.load(response.body)
+        else
+          error_class = Pinnacle::Errors::ResponseError.subclass_for_code(code)
+          raise error_class.new(response.body, code: code)
+        end
+      end
+
+      # @return [Pinnacle::Submissions::Client]
+      def submissions
+        @submissions ||= Pinnacle::Forms::Submissions::Client.new(client: @client)
+      end
+    end
+  end
+end

data/lib/pinnacle/forms/submissions/client.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+module Pinnacle
+  module Forms
+    module Submissions
+      class Client
+        # @param client [Pinnacle::Internal::Http::RawClient]
+        #
+        # @return [void]
+        def initialize(client:)
+          @client = client
+        end
+
+        # Paginated list of completed submissions for a form, newest first. Each row includes the submitted `data` keyed
+        # by field `key`, the sender/recipient, IP, user-agent, and timestamps.
+        #
+        # @param request_options [Hash]
+        # @param params [Pinnacle::Forms::Submissions::Types::ListFormSubmissionsParams]
+        # @option request_options [String] :base_url
+        # @option request_options [Hash{String => Object}] :additional_headers
+        # @option request_options [Hash{String => Object}] :additional_query_parameters
+        # @option request_options [Hash{String => Object}] :additional_body_parameters
+        # @option request_options [Integer] :timeout_in_seconds
+        # @option params [String] :id
+        #
+        # @return [Pinnacle::Types::ListFormSubmissionsResponse]
+        def list(request_options: {}, **params)
+          params = Pinnacle::Internal::Types::Utils.normalize_keys(params)
+          request_data = Pinnacle::Forms::Submissions::Types::ListFormSubmissionsParams.new(params).to_h
+          non_body_param_names = ["id"]
+          body = request_data.except(*non_body_param_names)
+
+          request = Pinnacle::Internal::JSON::Request.new(
+            base_url: request_options[:base_url],
+            method: "POST",
+            path: "forms/#{URI.encode_uri_component(params[:id].to_s)}/submissions/list",
+            body: body,
+            request_options: request_options
+          )
+          begin
+            response = @client.send(request)
+          rescue Net::HTTPRequestTimeout
+            raise Pinnacle::Errors::TimeoutError
+          end
+          code = response.code.to_i
+          if code.between?(200, 299)
+            Pinnacle::Types::ListFormSubmissionsResponse.load(response.body)
+          else
+            error_class = Pinnacle::Errors::ResponseError.subclass_for_code(code)
+            raise error_class.new(response.body, code: code)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pinnacle/forms/submissions/types/list_form_submissions_params.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Pinnacle
+  module Forms
+    module Submissions
+      module Types
+        class ListFormSubmissionsParams < Internal::Types::Model
+          field :id, -> { String }, optional: false, nullable: false
+          field :page_index, -> { Integer }, optional: true, nullable: false, api_name: "pageIndex"
+          field :page_size, -> { Integer }, optional: true, nullable: false, api_name: "pageSize"
+        end
+      end
+    end
+  end
+end

data/lib/pinnacle/forms/types/forms_send_response.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module Pinnacle
+  module Forms
+    module Types
+      class FormsSendResponse < Internal::Types::Model
+        extend Pinnacle::Internal::Types::Union
+
+        member -> { Pinnacle::Types::SendFormResult }
+        member -> { Pinnacle::Types::ScheduledFormSendResult }
+      end
+    end
+  end
+end

data/lib/pinnacle/forms/types/list_forms_params.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module Pinnacle
+  module Forms
+    module Types
+      class ListFormsParams < Internal::Types::Model
+        field :page_index, -> { Integer }, optional: true, nullable: false, api_name: "pageIndex"
+        field :page_size, -> { Integer }, optional: true, nullable: false, api_name: "pageSize"
+      end
+    end
+  end
+end

data/lib/pinnacle/forms/types/update_form_params.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module Pinnacle
+  module Forms
+    module Types
+      class UpdateFormParams < Internal::Types::Model
+        field :id, -> { String }, optional: false, nullable: false
+        field :name, -> { String }, optional: true, nullable: false
+        field :description, -> { String }, optional: true, nullable: false
+        field :fields, -> { Internal::Types::Array[Pinnacle::Types::FormField] }, optional: true, nullable: false
+        field :can_update, -> { Internal::Types::Boolean }, optional: true, nullable: false
+        field :expires_at, -> { String }, optional: true, nullable: false
+        field :theme_override, -> { Pinnacle::Types::FormThemeOverride }, optional: true, nullable: false
+        field :archived_at, -> { String }, optional: true, nullable: false
+      end
+    end
+  end
+end

data/lib/pinnacle/internal/http/base_request.rb

@@ -31,6 +31,20 @@ module Pinnacle
         # Child classes should implement:
         # - encode_headers: Returns the encoded HTTP request headers.
         # - encode_body: Returns the encoded HTTP request body.
+
+        private
+
+        # Merges additional_headers from request_options into sdk_headers, filtering out
+        # any keys that collide with SDK-set or client-protected headers (case-insensitive).
+        # @param sdk_headers [Hash] Headers set by the SDK for this request type.
+        # @param protected_keys [Array<String>] Additional header keys that must not be overridden.
+        # @return [Hash] The merged headers.
+        def merge_additional_headers(sdk_headers, protected_keys: [])
+          additional_headers = @request_options&.dig(:additional_headers) || @request_options&.dig("additional_headers") || {}
+          all_protected = (sdk_headers.keys + protected_keys).to_set { |k| k.to_s.downcase }
+          filtered = additional_headers.reject { |key, _| all_protected.include?(key.to_s.downcase) }
+          sdk_headers.merge(filtered)
+        end
       end
     end
   end

data/lib/pinnacle/internal/http/raw_client.rb

@@ -43,7 +43,7 @@ module Pinnacle
             http_request = build_http_request(
               url:,
               method: request.method,
-              headers: request.encode_headers,
+              headers: request.encode_headers(protected_keys: @default_headers.keys),
               body: request.encode_body
             )
 
@@ -120,6 +120,8 @@ module Pinnacle
           [delay + jitter, 0].max
         end
 
+        LOCALHOST_HOSTS = %w[localhost 127.0.0.1 [::1]].freeze
+
         # @param request [Pinnacle::Internal::Http::BaseRequest] The HTTP request.
         # @return [URI::Generic] The URL.
         def build_url(request)
@@ -129,14 +131,29 @@ module Pinnacle
           if request.path.start_with?("http://", "https://")
             url = request.path
             url = "#{url}?#{encode_query(encoded_query)}" if encoded_query&.any?
-            return URI.parse(url)
+            parsed = URI.parse(url)
+            validate_https!(parsed)
+            return parsed
           end
 
           path = request.path.start_with?("/") ? request.path[1..] : request.path
           base = request.base_url || @base_url
           url = "#{base.chomp("/")}/#{path}"
           url = "#{url}?#{encode_query(encoded_query)}" if encoded_query&.any?
-          URI.parse(url)
+          parsed = URI.parse(url)
+          validate_https!(parsed)
+          parsed
+        end
+
+        # Raises if the URL uses http:// for a non-localhost host, which would
+        # send authentication credentials in plaintext.
+        # @param url [URI::Generic] The parsed URL.
+        def validate_https!(url)
+          return if url.scheme != "http"
+          return if LOCALHOST_HOSTS.include?(url.host)
+
+          raise ArgumentError, "Refusing to send request to non-HTTPS URL: #{url}. " \
+                               "HTTP is only allowed for localhost. Use HTTPS or pass a localhost URL."
         end
 
         # @param url [URI::Generic] The url to the resource.
@@ -180,6 +197,7 @@ module Pinnacle
 
           http = Net::HTTP.new(url.host, port)
           http.use_ssl = is_https
+          http.verify_mode = OpenSSL::SSL::VERIFY_PEER if is_https
           # NOTE: We handle retries at the application level with HTTP status code awareness,
           # so we set max_retries to 0 to disable Net::HTTP's built-in network-level retries.
           http.max_retries = 0

data/lib/pinnacle/internal/json/request.rb

@@ -21,12 +21,14 @@ module Pinnacle
         end
 
         # @return [Hash] The encoded HTTP request headers.
-        def encode_headers
-          additional_headers = @request_options&.dig(:additional_headers) || @request_options&.dig("additional_headers") || {}
-          {
+        # @param protected_keys [Array<String>] Header keys set by the SDK client (e.g. auth, metadata)
+        #   that must not be overridden by additional_headers from request_options.
+        def encode_headers(protected_keys: [])
+          sdk_headers = {
             "Content-Type" => "application/json",
             "Accept" => "application/json"
-          }.merge(@headers).merge(additional_headers)
+          }.merge(@headers)
+          merge_additional_headers(sdk_headers, protected_keys:)
         end
 
         # @return [String, nil] The encoded HTTP request body.

data/lib/pinnacle/internal/multipart/multipart_request.rb

@@ -21,11 +21,13 @@ module Pinnacle
         end
 
         # @return [Hash] The encoded HTTP request headers.
-        def encode_headers
-          additional_headers = @request_options&.dig(:additional_headers) || @request_options&.dig("additional_headers") || {}
-          {
+        # @param protected_keys [Array<String>] Header keys set by the SDK client (e.g. auth, metadata)
+        #   that must not be overridden by additional_headers from request_options.
+        def encode_headers(protected_keys: [])
+          sdk_headers = {
             "Content-Type" => @body.content_type
-          }.merge(@headers).merge(additional_headers)
+          }.merge(@headers)
+          merge_additional_headers(sdk_headers, protected_keys:)
         end
 
         # @return [String, nil] The encoded HTTP request body.

data/lib/pinnacle/internal/types/union.rb

@@ -21,7 +21,7 @@ module Pinnacle
           self
         end
 
-        def member?(type)
+        def type_member?(type)
           members.any? { |_key, type_fn| type == type_fn.call }
         end