twilio-ruby 7.11.3 → 7.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 92782df8271f1b9a7f8ee80b10514048392c27dc6d58c3513e21a8fa2592a74e
-  data.tar.gz: 031343a9310ec971d5d015aaadd5df55ab781a9cacfd15b53dc6bf79b95fae05
+  metadata.gz: '0587ac5e14138ede69b18d56ff5965fa106d30ec11e17c08db0ca823a5bc64c7'
+  data.tar.gz: b07c0cf304d869f8d700e1ad5c37065b22bf2385340df09d6f2e29870d58e068
 SHA512:
-  metadata.gz: cdcf4946f4391697754789328369c248036fc05a7217ee4d60a4bad9ef2e61f6e0ec4fbcaddbca51b141d7d771ce1fefc55dcba49bd775af43521b8b73a86e28
-  data.tar.gz: 170130144ac18fbe7dc463683ea7ddea4494ba27fc329f29a801a44f317fb4c19ba9fbeb72d0d506c4c94d50efe239cc46e78c157c425de0200186662a7fbd59
+  metadata.gz: 448b5de7a2cd468f9e7c7029903eeba2ef39d1db284a66660100422a50e9ed60c422ff50ce1078e9e4864a167a6c58f0ead8c6689d305a279d5ca9c01f5fd452
+  data.tar.gz: b59a11d26dcd3eb65f27453259da7079fd966aff164261ef9c21ed015ffe0a006f8e493717f9a7c0ec0c40cc45e9358c0d6dc058e172c2b63f7b84104409ec9c

data/CHANGES.md

@@ -1,5 +1,282 @@
 twilio-ruby changelog
 =====================
+[2026-11-05] Version 7.13.0
+---------------------------
+**Library - Chore**
+- [PR #820](https://github.com/twilio/twilio-ruby/pull/820): support HMAC-SHA256 webhook signatures in RequestValidator. Thanks to [@sbansla](https://github.com/sbansla)!
+
+**Twiml**
+- Add ElevenLabs voices to `<Say>` verb.
+- Add `partialPromptOnHangup`, `eagerEotThreshold`, `asrSmartFormat`, `ttsTextNormalization`, `ttsLanguageTextNormalization`, `elevenlabsLanguageTextNormalization`, `includeInPrompt`, `customerName`, `applicationReconnect`, `echoPromptFiltering`, `turnDetection` attributes to `<ConversationRelay>`, and `hints`, `asrSmartFormat`, `ttsTextNormalization`, `ttsLanguageTextNormalization` attributes to `<Language>`
+
+**Api**
+- # API Changes
+- ## 2026-09-22
+- Simplified the `criteria` field description.
+- ## 2026-09-18
+- Moved `readOnly` on the snapshot count fields (`profileCount`, `partitionCount`) from the shared schema to the response usage sites, so the counts stay read-only in responses (no change for API consumers).
+- ## 2026-09-17
+- Renamed 3 `Get*` operations to `Fetch*` to match the operationId standard: `FetchCohort`, `FetchSnapshot`, `FetchOperation`.
+- Removed the unused `ExpressionId` schema and made the operation error example cohort-native, so no `aud_` identifiers remain in the spec.
+- Kept `libraryVisibility: hidden` across the whole surface (info, path items, and operations).
+- ## 2026-09-08
+- Removed the deprecated header-based-versioning unified specs, consolidating audiences onto the path-based `api.twilio.com/v1` surface.
+- ## 2026-08-31
+- Published the unified audiences spec at `api.twilio.com/v1`.
+- ## 2026-08-26
+- Fixed the Cohort operation response mapping in the unified audiences API.
+- ## 2026-08-19
+- Migrated the unified audiences spec to the Cohort surface (Audiences renamed to Cohorts).
+- Switched `downstreamServiceName` to `audiences-domain`.
+- ## 2026-08-05
+- Added the `api.unified.version.preview` beta feature.
+- Made the unified APIs available in prod us1.
+- ## 2026-07-30
+- Fixed example values.
+- ## 2026-07-29
+- Added the initial version of the audiences API to the unified APIs.
+- ## 2026-07-20
+- Deployed the audiences-domain OAS to the dev edge.
+- ## 2026-07-06
+- Added the prod-us1 realm to the audiences public API.
+- ## 2026-06-23
+- Changed the `storeType` enum from `MEMORA` to `TWILIO`.
+- ## 2026-05-04
+- Added the stage-us1 realm and `x-rate-limit` to the audiences API.
+- ## 2026-04-08
+- Added the initial audiences endpoints.
+- # API Changes
+- ## 2026-10-28
+- Enabled the Redaction Configurations and Redaction Catalog resources in prod-us1.
+- ## 2026-10-27
+- Enabled the Redaction Configurations and Redaction Catalog resources in stage-us1.
+- ## 2026-09-28
+- Added the Redaction Configurations resource (`/v1/RedactionConfigurations`) as a private beta in dev-us1, gated by the `api.redaction.enabled` beta feature.
+- Added the Redaction Catalog resource (`/v1/RedactionCatalog`), under the same beta feature. It is restricted to One Console.
+- Add `ApplicationSid` parameter to TwimlSession and TwimlProcess Create endpoints
+
+**Audiences**
+- ## 2026-10-23
+- **Content updates**:
+- Updated description for `AdminFetchRecord`
+- Updated description for `AdminListCohorts`
+- Updated description for `AdminListCohortSnapshots`
+- Updated description for `AdminFetchCohortOperation`
+- Updated description for `AdminListSnapshotOperations`
+- Updated schema description for `OperationStatus`
+- Added properties to `Cohort`: tags
+- Removed properties from `Cohort`: labels
+- Added properties to `CohortSnapshot`: tags
+- Removed properties from `CohortSnapshot`: labels
+- ## 2026-10-23
+- **Content updates**:
+- Updated description for `ListCohorts`
+- Updated description for `CreateCohort`
+- Updated description for `UpdateCohort`
+- Updated description for `ListCohortSnapshots`
+- Updated description for `CreateCohortSnapshot`
+- Updated description for `FetchCohortOperation`
+- Updated schema description for `OperationStatus`
+- Added properties to `Cohort`: tags
+- Removed properties from `Cohort`: labels
+- Added properties to `CohortSnapshot`: tags
+- ...and 8 more changes
+- ## 2026-10-14
+- Minor updates (formatting, metadata)
+- ## 2026-10-07
+- Minor updates (formatting, metadata)
+
+**Conversations**
+- Enable the Imports endpoints (list, create, fetch, cancel) and the Import Outcomes list endpoint in prod-us1
+- Add GET /v2/Imports/{ImportId}/Outcomes to list an import's per-resource outcomes (dev-us1 and stage-us1)
+- Add `EMAIL` to the Conversations v2 Communication channel enum.
+
+**Deletions**
+- ## 2026-10-28
+- Enable the User Data Deletions API in the `stage-us1` realm.
+
+**Destinations**
+- ## 2026-11-03
+- Enable Replay admin APIs for prod-us1 and prod-ie1 realms
+
+**Iam**
+- Raised the most permissions in a POST /v1/Account/AuthorizedApps section, and in a part of the PUT /v1/Organization/AgentsRegistration/Permissions request, to 2000 for MCP agents; the limit of other consents is unchanged
+- Lowered the most permissions in a POST /v1/Account/AuthorizedApps section to 150, which is what an XMS policy holds
+- Made the GET and PUT /v1/Organization/AgentsRegistration/Permissions routes available in stage-us1 and prod-us1
+- Added the MCP agent consent fields to GET /v1/Account/AuthorizedApps: agent, account, organization, sections (the offered permissions per context) and redirect, and a 401 body with redirect when the account's organization has not registered or enabled the agent (code 25110, with organization_sid) or the account has no organization (code 25111). oauth_app_sid, client_sid, consent_state and app_permissions are now nullable, since an MCP agent response does not use them
+- Added sections (at least 1) with permissionSelectionMode (ALL_READ, ALL_READ_WRITE, SPECIFIC) and permissions (at most 200) to the POST /v1/Account/AuthorizedApps request, and response_mode and form_params to its 201 response
+- Made the /v1/Organization/AgentsRegistration routes available in stage-us1 and prod-us1
+- Added created_by (the name of the user who registered the agent) and created_by_sid to the /v1/Organization/AgentsRegistration responses; both are null for a registration made before the user was recorded
+- Moved the POST /v1/actions/post_login (PostLoginActionRequest) webhook payload to camelCase (accountSid, nodeId, actionId, userContext, authenticationContext, requestContext, ipAddress, userAgent, requestId, clientId, identifierType); replaced timestamp with the RFC 3339 sentAt, made authorizationDetails a JSON array, made completedAt an RFC 3339 string, and added userContext (isFirstLogin, user) with the CIAM id at userContext.user.userId
+- Added the optional type, agent, account, organization, sections, last_used and expires_at to the iam.v1.consent responses of the GET /v1/Account/AuthorizedApps and GET /v1/Organization/AuthorizedApps lists, for MCP connections. The list shows an MCP connection beside the OAuth applications, and deleting it revokes the whole connection
+- Added a 404 to PUT /v1/Account/AuthorizedApps/{consentSid} for an MCP connection, which cannot be updated
+- Added the GET and PUT /v1/Organization/AgentsRegistration/Permissions routes for what any agent may do in the caller's organization (dev-us1)
+- Renamed the properties of the /v1/Organization/AgentsRegistration responses to snake_case (registration_sid, friendly_name, client_url, date_created, date_updated), as the other IAM responses are; the request bodies keep clientUrl and enabled
+- Fixed the pagination meta of the GET /v1/Organization/AgentsRegistration response: it is mapped from the service's snake_case fields, as in the other IAM list routes, so key, pageSize and the tokens are no longer null
+- Added the /v1/Organization/AgentsRegistration routes (list, register, fetch, enable or disable, remove) for the MCP agents an organization lets its users connect (dev-us1)
+
+**Instrumentation**
+- # API Changes
+- ## 2026-10-12
+- Initial read-only admin-api spec for the Behavioral Events (events-domain) One Admin console: event producers (list, fetch), write keys (list), event schemas (list, fetch). dev-us1 and stage-us1 only.
+- ## 2026-10-27
+- **Control Plane create, update and attach are synchronous** (`dev-us1`), matching the deployed service:
+- CreateEventProducer returns `201` with the event producer (`ETag`, `Idempotent-Replayed`), not `202` with an operation
+- PatchEventProducer returns `200` with the event producer (`ETag`), not `202`; `If-Match` is its only header parameter
+- AttachEventProducerSchemaVersion returns `201` with the attachment (`Idempotent-Replayed`), not `202`
+- ## 2026-10-21
+- **Replaced the Control Plane with the private-beta API** (`/v1/ControlPlane/…`), enabled in `dev-us1` only:
+- Removed the EventSources, Datasets, EventSources EventSchemas and AutoInstrumentationRules operations
+- Added `/v1/ControlPlane/EventProducers` (CreateEventProducer, ListEventProducers)
+- Added `/v1/ControlPlane/EventProducers/{producerId}` (FetchEventProducer, PatchEventProducer, DeleteEventProducer)
+- Added `/v1/ControlPlane/EventProducers/{producerId}/WriteKeys` (CreateWriteKey, ListWriteKeys)
+- Added `/v1/ControlPlane/EventProducers/{producerId}/WriteKeys/{writeKey}` (DeleteWriteKey)
+- Added `/v1/ControlPlane/EventProducers/{producerId}/EventSchemas` (AttachEventProducerSchemaVersion, ListEventProducerSchemaAttachments)
+- Added `/v1/ControlPlane/EventProducers/{producerId}/EventSchemas/{schemaId}/Versions/{version}` (DetachEventProducerSchemaVersion)
+- Added `/v1/ControlPlane/EventSchemas` (CreateEventSchema, ListEventSchemas)
+- Added `/v1/ControlPlane/EventSchemas/{schemaId}` (FetchEventSchema, PatchEventSchema, DeleteEventSchema)
+- Added `/v1/ControlPlane/EventSchemas/{schemaId}/Versions` (ListEventSchemaVersions)
+- Added `/v1/ControlPlane/EventSchemas/{schemaId}/Versions/{version}` (FetchEventSchemaVersion, DeleteEventSchemaVersion)
+- Updated `/v1/ControlPlane/Operations/{operationId}` (FetchControlPlaneOperationStatus) to the new operation shape; now `dev-us1` only
+
+**Knowledge**
+- ## 2026-10-27
+- **Added 1 new path(s)**:
+- `/v2/ControlPlane/KnowledgeMigrations/{accountSid}/Limits` (AdminFetchKnowledgeMigrationLimits)
+- ## 2026-10-21
+- **Content updates**:
+- `AdminListKnowledgeMigrations`: the `state` query parameter is optional; without it the list returns every account with knowledge bases
+- Added properties to `MigrationSummary`: knowledgeBaseCount
+- ## 2026-10-19
+- **Added 7 new path(s)**:
+- `/v2/ControlPlane/KnowledgeMigrations` (AdminListKnowledgeMigrations)
+- `/v2/ControlPlane/KnowledgeMigrations/{accountSid}` (AdminFetchKnowledgeMigration)
+- `/v2/ControlPlane/KnowledgeMigrations/{accountSid}/History` (AdminListKnowledgeMigrationHistory)
+- `/v2/ControlPlane/KnowledgeMigrations/{accountSid}/Readiness` (AdminFetchKnowledgeMigrationReadiness)
+- `/v2/ControlPlane/KnowledgeMigrations/{accountSid}/Runs` (AdminListKnowledgeMigrationRuns)
+- `/v2/ControlPlane/KnowledgeMigrations/{accountSid}/Transitions` (AdminListKnowledgeMigrationTransitions, AdminCreateKnowledgeMigrationTransition)
+- `/v2/ControlPlane/KnowledgeMigrations/{accountSid}/Transitions/{transitionId}` (AdminFetchKnowledgeMigrationTransition)
+
+**Lookups**
+- Add test api support for Lookup Bulk Jobs endpoints
+
+**Memory**
+- ## 2026-10-14
+- No path changes (schema only)
+- Added optional `dataAsOf` to the `Store` schema returned by `AdminFetchStore`.
+- ## 2026-10-14
+- Added optional `dataAsOf` to the `Store` schema returned by `FetchStore`.
+- ## 2026-10-08
+- Added `FetchProfileOperation` (`GET /v1/ProfileOperations/{operationId}`) to check the status and
+- progress of an asynchronous profile operation. The response includes a `Retry-After` header with
+- the minimum number of seconds to wait before polling again. The endpoint is hidden from the
+- helper libraries and gated behind the `api.memory.2026Q3` beta feature.
+- The `202` responses of `UpdateProfilesBulk` and `CreateProfilesImportV2` now return `operationId`,
+- `createdAt` and `statusUrl` (behind the `api.memory.2026Q3` beta feature), plus the `Operation-Id`,
+- `Location` and `Retry-After` response headers. Use `statusUrl` with `FetchProfileOperation` to
+- track the operation.
+- Additive and backwards compatible: existing request and response fields are unchanged.
+
+**Messaging**
+- Add data access policy admin endpoints (`GET/PUT /v1/Accounts/{AccountSid}/DataAccessPolicy`) to the messaging admin-api, backed by `postflight-messaging-api` (dev-us1 and stage-us1 only)
+- Enable data access policy admin endpoints (`GET/PUT /v1/Accounts/{AccountSid}/DataAccessPolicy`) in prod-us1 and prod-ie1
+
+**Segment**
+- # API Changes
+- ## 2026-11-04
+- Add read-only Cob routes: `GET /v1/Segment/Cob/Whoami`, `/Records`, `/Audits`, `/Audits/{Family}/{Name}`
+- ## 2026-10-30
+- Add `GET /v1/Whoami` (One Admin identity check for the Segment oneadmin-gateway)
+
+**Trusthub**
+- Make id, sessionId and sessionToken required and non-nullable in the A2P embedded session response. **(breaking change)**
+
+**Voice**
+- Add internal console ProvisioningStatus endpoint.
+
+**Webhooks**
+- ## 2026-10-28
+- **Changed**: Rule `prefix` and `value` are limited to 1000 characters. A `prefix` must end with `/` and a `value` must not.
+- ## 2026-10-13
+- API maturity level changed from `beta` to `ga`. Library visibility changed from `private` to `public`.
+
+
+[2026-10-12] Version 7.12.0
+---------------------------
+**Audiences**
+- ## 2026-10-06
+- Minor updates (formatting, metadata)
+- ## 2026-10-05
+- Minor updates (formatting, metadata)
+- ## 2026-10-02
+- **Added 1 new path(s)**:
+- `/preview/Cohorts/{cohortId}/Operations` (AdminListCohortOperations)
+- ## 2026-10-01
+- **Content updates**:
+- Updated description for `AdminListSnapshotOperations`
+- ## 2026-09-28
+- **Content updates**:
+- Updated description for `AdminListCohortSnapshots`
+- Updated description for `AdminFetchCohortSnapshot`
+- Updated schema description for `Criteria`
+- Added properties to `OperationPayload`: cohortId
+- Removed properties from `OperationPayload`: audienceId
+- Updated schema description for `OperationResult`
+- Added properties to `OperationResult`: cohortId
+- Removed properties from `OperationResult`: audienceId
+- Updated schema description for `Record`
+- Updated schema description for `Cohort`
+- ...and 3 more changes
+- ## 2026-10-01
+- Minor updates (formatting, metadata)
+- ## 2026-09-28
+- **Content updates**:
+- Updated schema description for `CohortOperationResult`
+- Updated schema description for `PartitionCount`
+
+**Conversations**
+- Add PATCH /v2/Imports/{id} to cancel an import, and the `CANCELED` import status (dev-us1 and stage-us1)
+- Add Imports endpoints for 1console (private visibility, dev-us1 and stage-us1)
+- Add `traitExtractionStrategyIds` and `observationExtractionStrategyIds` to the Conversations v2 Admin Configuration schema.
+- Align the Conversations v2 Capabilities list and create contracts with the backend `domainId` field.
+
+**Data-ingress**
+- ## 2026-10-01
+- Minor updates (formatting, metadata)
+- ## 2026-09-17
+- Add support for Hubspot connector
+- ## 2026-10-01
+- Minor updates (formatting, metadata)
+- ## 2026-09-17
+- Add support for Hubspot connector
+
+**Events**
+- Remove the Replays API (`/v1/Replays`, beta feature `api.eventstreams.replay`); the feature was never GA and is being sunset **(breaking change)**
+
+**Knowledge**
+- ## 2026-09-24
+- **Routing updates**:
+- Changed `downstreamServiceName` from `memora-domain` to `enterprise-knowledge-domain` for all operations
+
+**Memory**
+- ## 2026-09-30
+- The `source` field on observations and conversation summaries, and the `source` filter
+- on `ListProfileObservations`, now also accept forward slashes (`/`). The pattern is
+- `^[a-zA-Z0-9 _./-]+$`. This is additive and backwards compatible: every previously
+- valid value is still accepted.
+- `UpdateStore`, `UpdateTraitGroup`, and `UpdateDataMapping` now require a body with at least one property. An empty `{}` gets a 400.
+
+**Messaging**
+- Add opt-out configuration admin endpoints (`GET/PUT/DELETE /v1/Accounts/{AccountSid}/OptOuts/{OptOutSid}/...`) to the messaging admin-api (dev-us1 and stage-us1 only)
+- Add create opt-out configuration endpoint (`POST /v1/Accounts/{AccountSid}/OptOuts`) to the messaging admin-api (dev-us1 and stage-us1 only)
+- Add update messaging service endpoint (`PUT /v1/Accounts/{AccountSid}/Services/{MessagingServiceSid}`) to the messaging admin-api (dev-us1 and stage-us1 only)
+- Enable messaging service add-ons, update messaging service, and opt-out configuration admin endpoints in prod-us1 and prod-ie1
+- Add WhatsApp display name change support to Sender API: `pending_display_name`, `pending_display_name_status` and `pending_display_name_status_date` on fetch, and `display_name_status` on update and partial update
+
+**Routes**
+- Set SDK and docs visibility of `GET`/`POST` `/v3/ShortCodes/{isoCountryCode}/{shortCode}` to `public`, maturity to `ga`
+
+
 [2026-09-28] Version 7.11.3
 ---------------------------
 **Library - Fix**

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    twilio-ruby (7.11.3)
+    twilio-ruby (7.13.0)
       faraday (>= 2.0, < 3.0)
       jwt (>= 1.5, < 4.0)
       nokogiri (>= 1.6, < 2.0)
@@ -144,7 +144,7 @@ CHECKSUMS
   rubocop-ast (1.50.0) sha256=b9ca88300da0803ee222ad20cdb30494c0a784eed06fdc35d254b06d662788db
   ruby-progressbar (1.13.0) sha256=80fc9c47a9b640d6834e0dc7b3c94c9df37f08cb072b7761e4a71e22cff29b33
   simplecov (1.0.3) sha256=38ef0514f16ae7562f0d0f4df02610071115103d301b6de7dacbcc000082e39b
-  twilio-ruby (7.11.3)
+  twilio-ruby (7.13.0)
   unicode-display_width (3.2.0) sha256=0cdd96b5681a5949cdbc2c55e7b420facae74c4aaf9a9815eee1087cb1853c42
   unicode-emoji (4.2.0) sha256=519e69150f75652e40bf736106cfbc8f0f73aa3fb6a65afe62fefa7f80b0f80f
   uri (1.1.1) sha256=379fa58d27ffb1387eaada68c749d1426738bd0f654d812fcc07e7568f5c57c6

data/README.md

@@ -39,13 +39,13 @@ This library supports the following Ruby implementations:
 To install using [Bundler][bundler] grab the latest stable version:
 
 ```ruby
-gem 'twilio-ruby', '~> 7.11.3'
+gem 'twilio-ruby', '~> 7.13.0'
 ```
 
 To manually install `twilio-ruby` via [Rubygems][rubygems] simply gem install:
 
 ```bash
-gem install twilio-ruby -v 7.11.3
+gem install twilio-ruby -v 7.13.0
 ```
 
 To build and install the development branch yourself from the latest source:

data/examples/WebhookSignatureValidation.md

@@ -0,0 +1,61 @@
+# Validating webhook signatures (HMAC-SHA1 and HMAC-SHA256)
+
+By default Twilio signs webhooks with your Auth Token using HMAC-SHA1. If a
+[Webhooks Rule](https://www.twilio.com/docs/usage/webhooks/webhook-rules) matches the webhook URL, Twilio signs
+with the Setting's SharedKey and algorithm instead, and adds this header:
+
+```
+X-Twilio-Webhooks-Signature-Settings: key=<sharedKeyId>,algorithm=HMAC_SHA256
+```
+
+Only the hash changes. The signed string is still the full URL followed by the sorted POST parameters.
+
+## Option 1: Rack middleware
+
+`Rack::TwilioWebhookAuthentication` reads the header for you. Pass the SharedKey secret next to the Auth Token:
+
+```ruby
+require 'rack'
+
+use Rack::TwilioWebhookAuthentication, ENV['AUTH_TOKEN'], /\/voice/,
+    shared_key_secret: ENV['SHARED_KEY_SECRET']
+```
+
+- Header absent: validates with the Auth Token and HMAC-SHA1.
+- Header present: validates with `shared_key_secret` and the header's algorithm.
+- Invalid signature or unsupported algorithm: responds 403.
+- Header present but `shared_key_secret` not set: responds 500.
+
+## Option 2: Validate manually
+
+```ruby
+validator_class = Twilio::Security::RequestValidator
+
+signature = request.env['HTTP_X_TWILIO_SIGNATURE']
+settings  = request.env['HTTP_X_TWILIO_WEBHOOKS_SIGNATURE_SETTINGS']
+
+# No header means the Auth Token and HMAC_SHA1
+secret    = settings ? shared_key_secret : auth_token
+algorithm = validator_class.signature_algorithm(settings)
+
+validator = validator_class.new(secret)
+
+# Form-encoded body
+valid = validator.validate(url, params, signature, algorithm)
+
+# JSON body (the URL carries bodySHA256)
+valid_json = validator.validate(url, raw_body, signature, algorithm)
+```
+
+If you use more than one SharedKey, look up the secret by the `key=` value in the header.
+
+Twilio signs empty parameters too, so keep them when you parse the form body (for example `URI.decode_www_form`).
+
+## Existing code
+
+The `algorithm` argument is optional and defaults to HMAC-SHA1, so code that validates with the Auth Token needs no change:
+
+```ruby
+Twilio::Security::RequestValidator.new(auth_token).validate(url, params, signature)
+use Rack::TwilioWebhookAuthentication, ENV['AUTH_TOKEN'], /\/voice/
+```

data/lib/rack/twilio_webhook_authentication.rb

@@ -20,15 +20,28 @@ module Rack
   # the ENV and only against paths that match /\/messages/. If the request
   # validates then it gets passed on to the action as normal. If the request
   # doesn't validate then the middleware responds immediately with a 403 status.
+  #
+  # Webhooks signed with a SharedKey (see the Webhooks Rules API) carry an
+  # X-Twilio-Webhooks-Signature-Settings header naming the signing algorithm, and
+  # are signed with the SharedKey secret instead of the auth token. Pass it with
+  # the shared_key_secret option:
+  #
+  # use Rack::TwilioWebhookAuthentication, ENV['AUTH_TOKEN'], /\/voice/, shared_key_secret: ENV['SHARED_KEY_SECRET']
+  #
+  # Requests without that header are still validated with the auth token and
+  # HMAC-SHA1. A request with the header but no shared_key_secret configured gets
+  # a 500, as the middleware cannot validate it.
 
   class TwilioWebhookAuthentication
     # Rack's FORM_DATA_MEDIA_TYPES can be modified to taste, so we're slightly
     # more conservative in what we consider form data.
     FORM_URLENCODED_MEDIA_TYPE = Rack::MediaType.type('application/x-www-form-urlencoded')
+    SIGNATURE_SETTINGS_ENV_KEY = 'HTTP_X_TWILIO_WEBHOOKS_SIGNATURE_SETTINGS'
 
-    def initialize(app, auth_token, *paths, &auth_token_lookup)
+    def initialize(app, auth_token, *paths, shared_key_secret: nil, &auth_token_lookup)
       @app = app
       @auth_token = auth_token
+      @shared_key_secret = shared_key_secret
       define_singleton_method(:get_auth_token, auth_token_lookup) if block_given?
       @path_regex = Regexp.union(paths)
     end
@@ -38,10 +51,14 @@ module Rack
       request = Rack::Request.new(env)
       original_url = request.url
       params = extract_params!(request)
-      auth_token = @auth_token || get_auth_token(params['AccountSid'])
-      validator = Twilio::Security::RequestValidator.new(auth_token)
+      signature_settings = env[SIGNATURE_SETTINGS_ENV_KEY]
+      secret = signature_settings ? @shared_key_secret : (@auth_token || get_auth_token(params['AccountSid']))
+      return missing_shared_key_secret_response if secret.nil?
+
+      validator = Twilio::Security::RequestValidator.new(secret)
       signature = env['HTTP_X_TWILIO_SIGNATURE'] || ''
-      if validator.validate(original_url, params, signature)
+      algorithm = Twilio::Security::RequestValidator.signature_algorithm(signature_settings)
+      if validator.validate(original_url, params, signature, algorithm)
         @app.call(env)
       else
         [
@@ -52,6 +69,14 @@ module Rack
       end
     end
 
+    def missing_shared_key_secret_response
+      [
+        500,
+        { 'Content-Type' => 'text/plain' },
+        ['Twilio Request Validation Failed: no SharedKey secret configured for a SharedKey-signed request.']
+      ]
+    end
+
     # Decide whether a request path needs its signature validated.
     #
     # PATH_INFO arrives percent-encoded, but the routers we sit in front of
@@ -110,6 +135,6 @@ module Rack
       end
     end
 
-    private :extract_params!, :protected_path?, :decode, :remove_dot_segments
+    private :missing_shared_key_secret_response, :extract_params!, :protected_path?, :decode, :remove_dot_segments
   end
 end

data/lib/twilio-ruby/rest/api/v2010/account/call.rb

@@ -1078,6 +1078,7 @@ module Twilio
                             'group_sid' => payload['group_sid'],
                             'caller_name' => payload['caller_name'],
                             'queue_time' => payload['queue_time'],
+                            'stir_verstat' => payload['stir_verstat'],
                             'trunk_sid' => payload['trunk_sid'],
                             'uri' => payload['uri'],
                             'subresource_uris' => payload['subresource_uris'],
@@ -1237,6 +1238,12 @@ module Twilio
                         @properties['queue_time']
                     end
                     
+                    ##
+                    # @return [String] The STIR/SHAKEN verification status of the call, for example `TN-Validation-Passed-A`. Empty if the incoming call had no STIR/SHAKEN information.
+                    def stir_verstat
+                        @properties['stir_verstat']
+                    end
+                    
                     ##
                     # @return [String] The unique identifier of the trunk resource that was used for this call. The field is empty if the call was not made using a SIP trunk or if the call is not terminated.
                     def trunk_sid

data/lib/twilio-ruby/rest/api/v2010/account/conference.rb

@@ -45,7 +45,7 @@ module Twilio
                     # @param [Date] date_updated_before Only include conferences that were last updated on this date. Specify a date as `YYYY-MM-DD` in UTC, for example: `2009-07-06`, to read only conferences that were last updated on this date. You can also specify an inequality, such as `DateUpdated<=YYYY-MM-DD`, to read conferences that were last updated on or before midnight of this date, and `DateUpdated>=YYYY-MM-DD` to read conferences that were last updated on or after midnight of this date.
                     # @param [Date] date_updated_after Only include conferences that were last updated on this date. Specify a date as `YYYY-MM-DD` in UTC, for example: `2009-07-06`, to read only conferences that were last updated on this date. You can also specify an inequality, such as `DateUpdated<=YYYY-MM-DD`, to read conferences that were last updated on or before midnight of this date, and `DateUpdated>=YYYY-MM-DD` to read conferences that were last updated on or after midnight of this date.
                     # @param [String] friendly_name The string that identifies the Conference resources to read.
-                    # @param [Status] status The status of the resources to read. Can be: `init`, `in-progress`, or `completed`.
+                    # @param [Status] status The status of the resources to read. Can be: `init`, `in-progress`, or `completed`. Starting from September 30th, 2026, the default is `in-progress`. To read completed conferences, set `Status` to `completed`.
                     # @param [Integer] limit Upper limit for the number of records to return. stream()
                     #    guarantees to never return more than limit.  Default is no limit
                     # @param [Integer] page_size Number of records to fetch per request, when
@@ -79,7 +79,7 @@ module Twilio
                     # @param [Date] date_updated_before Only include conferences that were last updated on this date. Specify a date as `YYYY-MM-DD` in UTC, for example: `2009-07-06`, to read only conferences that were last updated on this date. You can also specify an inequality, such as `DateUpdated<=YYYY-MM-DD`, to read conferences that were last updated on or before midnight of this date, and `DateUpdated>=YYYY-MM-DD` to read conferences that were last updated on or after midnight of this date.
                     # @param [Date] date_updated_after Only include conferences that were last updated on this date. Specify a date as `YYYY-MM-DD` in UTC, for example: `2009-07-06`, to read only conferences that were last updated on this date. You can also specify an inequality, such as `DateUpdated<=YYYY-MM-DD`, to read conferences that were last updated on or before midnight of this date, and `DateUpdated>=YYYY-MM-DD` to read conferences that were last updated on or after midnight of this date.
                     # @param [String] friendly_name The string that identifies the Conference resources to read.
-                    # @param [Status] status The status of the resources to read. Can be: `init`, `in-progress`, or `completed`.
+                    # @param [Status] status The status of the resources to read. Can be: `init`, `in-progress`, or `completed`. Starting from September 30th, 2026, the default is `in-progress`. To read completed conferences, set `Status` to `completed`.
                     # @param [Integer] limit Upper limit for the number of records to return. stream()
                     #    guarantees to never return more than limit.  Default is no limit
                     # @param [Integer] page_size Number of records to fetch per request, when
@@ -117,7 +117,7 @@ module Twilio
                       # @param [Date] date_updated_before Only include conferences that were last updated on this date. Specify a date as `YYYY-MM-DD` in UTC, for example: `2009-07-06`, to read only conferences that were last updated on this date. You can also specify an inequality, such as `DateUpdated<=YYYY-MM-DD`, to read conferences that were last updated on or before midnight of this date, and `DateUpdated>=YYYY-MM-DD` to read conferences that were last updated on or after midnight of this date.
                       # @param [Date] date_updated_after Only include conferences that were last updated on this date. Specify a date as `YYYY-MM-DD` in UTC, for example: `2009-07-06`, to read only conferences that were last updated on this date. You can also specify an inequality, such as `DateUpdated<=YYYY-MM-DD`, to read conferences that were last updated on or before midnight of this date, and `DateUpdated>=YYYY-MM-DD` to read conferences that were last updated on or after midnight of this date.
                       # @param [String] friendly_name The string that identifies the Conference resources to read.
-                      # @param [Status] status The status of the resources to read. Can be: `init`, `in-progress`, or `completed`.
+                      # @param [Status] status The status of the resources to read. Can be: `init`, `in-progress`, or `completed`. Starting from September 30th, 2026, the default is `in-progress`. To read completed conferences, set `Status` to `completed`.
                     # @param [Integer] limit Upper limit for the number of records to return. stream()
                     #    guarantees to never return more than limit.  Default is no limit
                     # @param [Integer] page_size Number of records to fetch per request, when
@@ -174,7 +174,7 @@ module Twilio
                     # @param [Date] date_updated_before Only include conferences that were last updated on this date. Specify a date as `YYYY-MM-DD` in UTC, for example: `2009-07-06`, to read only conferences that were last updated on this date. You can also specify an inequality, such as `DateUpdated<=YYYY-MM-DD`, to read conferences that were last updated on or before midnight of this date, and `DateUpdated>=YYYY-MM-DD` to read conferences that were last updated on or after midnight of this date.
                     # @param [Date] date_updated_after Only include conferences that were last updated on this date. Specify a date as `YYYY-MM-DD` in UTC, for example: `2009-07-06`, to read only conferences that were last updated on this date. You can also specify an inequality, such as `DateUpdated<=YYYY-MM-DD`, to read conferences that were last updated on or before midnight of this date, and `DateUpdated>=YYYY-MM-DD` to read conferences that were last updated on or after midnight of this date.
                     # @param [String] friendly_name The string that identifies the Conference resources to read.
-                    # @param [Status] status The status of the resources to read. Can be: `init`, `in-progress`, or `completed`.
+                    # @param [Status] status The status of the resources to read. Can be: `init`, `in-progress`, or `completed`. Starting from September 30th, 2026, the default is `in-progress`. To read completed conferences, set `Status` to `completed`.
                     # @param [String] page_token PageToken provided by the API
                     # @param [Integer] page_number Page Number, this value is simply for client state
                     # @param [Integer] page_size Number of records to return, defaults to 50

data/lib/twilio-ruby/rest/client.rb

@@ -202,6 +202,11 @@ module Twilio
                 @voice ||= Voice.new self
             end
             ##
+            # Access the Webhooks Twilio Domain
+            def webhooks
+                @webhooks ||= Webhooks.new self
+            end
+            ##
             # Access the Wireless Twilio Domain
             def wireless
                 @wireless ||= Wireless.new self