sendly 3.40.0__tar.gz → 4.0.0__tar.gz

{sendly-3.40.0 → sendly-4.0.0}/CHANGELOG.md

@@ -1,5 +1,159 @@
 # sendly (Python)
 
+## 4.0.0
+
+**Upgrading from 3.40.0:** that release already contained the breaking changes below, published by mistake as a minor version. 4.0.0 carries them under the correct major. Relative to 3.40.0, the only new changes are under **Security**.
+
+Webhook events are no longer decoded as messages. Every SDK used to force a webhook's
+`data.object` into a message-shaped type. That is correct for `message.*` and wrong for
+every lifecycle event — `rcs_*`, `whatsapp_*`, `call.*`, `brand.*`, `campaign.*`,
+`assignment.*`, `number.*`, `port*`, `contact*`, `conversation.*`, `draft.*`,
+`verification.*` — which carry a different object entirely. This release exposes the payload
+as it arrived and makes the wrong read fail instead of returning a plausible-looking zero.
+
+### Breaking Changes
+
+- **`event.data` is now `None` for every event that is not a `message.*` event.** It used to
+  be a fully-populated `WebhookMessageData` whatever arrived, assembled by reading message
+  field names off a payload that never carried them. Parsing an `rcs_agent.live` event
+  returned `id=''`, `status=''`, `to=''`, `from_=''`, `segments=1`, `credits_used=0`,
+  `direction='outbound'` — every one of those invented by the SDK — and **raised no error**.
+  A handler that logged `event.data.credits_used` recorded a `0` that meant nothing, and a
+  handler that branched on `event.data.status` took the empty-string branch forever.
+
+  Reading a message field off a lifecycle event now raises
+  `AttributeError: 'NoneType' object has no attribute 'id'`. **That is the point of this
+  release, not an accident.** The read was always wrong; it is now loud instead of silent,
+  so you find every affected call site the first time such an event arrives rather than
+  trusting a zero indefinitely.
+
+  Your code today, on any non-`message.*` event:
+
+  ```python
+  event = Webhooks.parse_event(payload, signature, WEBHOOK_SECRET, timestamp=timestamp)
+
+  if event.type == 'rcs_agent.live':
+      agent_id = event.data.id        # was always '' - the payload has no `id` at all
+      stage = event.data.status       # was always ''
+  ```
+
+  After upgrading, that raises. Read the payload off `event.object`, which carries
+  `data.object` verbatim:
+
+  ```python
+  event = Webhooks.parse_event(payload, signature, WEBHOOK_SECRET, timestamp=timestamp)
+
+  if event.type == 'rcs_agent.live':
+      agent_id = event.object['agent_id']
+      stage = event.object['stage']
+  ```
+
+  The edit is mechanical: on a lifecycle event, every `event.data.<field>` becomes
+  `event.object['<key>']`, with the key spelled the way the API sends it rather than the way
+  `WebhookMessageData` spelled it. There was no `event.object` before this release, so no
+  correct version of this code existed to migrate from — check what your handler assumed
+  rather than translating it field for field.
+
+  If a handler touches `event.data` in several branches, guard the message-only path once.
+  `if event.data is not None:` both narrows the type for a checker and marks the branch:
+
+  ```python
+  if event.data is not None:
+      record_delivery(event.data.id, event.data.status)
+  else:
+      handle_lifecycle(event.type, event.object)
+  ```
+
+  `message.*` handlers otherwise need no change: `event.data` is still the message view
+  there.
+
+- **`contact.auto_flagged` reported the wrong id, and code keyed on it acted on the wrong
+  record.** The payload is a contact — `{id, phone_number, invalid_reason, source,
+  message_id, error_code}` — so the old decode put the *contact* id in `event.data.id`, and
+  `event.data.message_id` (an alias for `id`) returned that same contact id. The message
+  that actually failed was unreachable. If you wrote `mark_bounced(event.data.id)`, it has
+  been handing a contact id to something that expects a message id:
+
+  ```python
+  # before - `event.data.id` is the CONTACT id, `event.data.message_id` is the same value
+  if event.type == 'contact.auto_flagged':
+      mark_bounced(event.data.id)
+
+  # after - the two ids are distinct and never swapped
+  if event.type == 'contact.auto_flagged':
+      flag_contact(event.object['id'])
+      mark_bounced(event.object['message_id'])
+  ```
+
+  Audit anything this handler wrote before you upgrade; the bad writes are already on disk.
+
+- **`message.opt_in` and `message.opt_out` also return `event.data is None`.** They share the
+  `message.` prefix but carry an opt-out record (`phone_number`, `keyword`, `from_number`,
+  `timestamp`), not a message, so the old decode produced an all-default message here too.
+  Read them from `event.object`. Use `is_message_event(event.type)` rather than testing the
+  prefix yourself — it knows about these two.
+
+- **`WebhookEventType` is an enum, not a `Literal` union.** `sendly.webhooks` used to define
+  its own `Literal[...]` of event-type strings, drifting from the `WebhookEventType` enum in
+  `sendly.types`. There is now one definition: `sendly.webhooks.WebhookEventType` re-exports
+  the enum, and `sendly.webhooks.WEBHOOK_EVENT_TYPES` is the tuple of its values. Runtime
+  comparisons are unaffected (it is a `str` enum, so `event.type == 'message.delivered'` and
+  `event.type == WebhookEventType.MESSAGE_DELIVERED` are both `True`), but an annotation like
+  `event_type: WebhookEventType = 'message.delivered'` no longer type-checks. Use
+  `WebhookEventType.MESSAGE_DELIVERED`, or annotate as `str`.
+
+- **`message.queued` and `message.undelivered` are gone.** The API has never emitted either
+  one and rejects both with a `400` on subscribe, so any `events` list containing them was
+  subscribing to nothing and any handler branch on them was dead. They are no longer in
+  `WebhookEventType` or `WEBHOOK_EVENT_TYPES`; `WebhookEventType.MESSAGE_QUEUED` now raises
+  `AttributeError`. Delete them from your `webhooks.create()` / `webhooks.update()` calls.
+  `'queued'` and `'undelivered'` are still valid message *statuses* on `event.data.status` —
+  only the event types were removed.
+
+- **`WebhookMessageData` fields no longer carry invented defaults.** Every field is now
+  `Optional` and defaults to `None`. On a `message.*` payload that omitted a key you used to
+  get `''` for `id` / `status` / `to` / `from_`, `1` for `segments`, `0` for `credits_used`
+  and `'outbound'` for `direction`; you now get `None`, so an absent value is
+  distinguishable from a real one. Code that did `if not event.data.to:` still works; code
+  that did `event.data.to.startswith('+')` or `event.data.segments + 1` unguarded will now
+  raise on a sparse payload. `WebhookVerificationData` lost its invented defaults the same
+  way (`delivery_status='queued'`, `attempts=0`, `max_attempts=3` are all `None` now).
+
+### Minor Changes
+
+- **`event.object`** — `data.object` exactly as it arrived, on every event type. Keys are
+  verbatim (`camelCase` stays `camelCase`), JSON `null` stays `None`, and nothing the payload
+  did not carry is added. `event.raw_object` is an alias for it.
+- **`event.object_as(cls)`** — decode the payload into a shape of your own: a dataclass, a
+  pydantic v2 model, or `dict`. `event.object_as()` with no argument returns a plain dict
+  copy. Only keys the payload actually carried are passed through, so a field it did not send
+  keeps its default rather than being invented, and a trailing underscore maps a reserved
+  word (`from_` reads `from`).
+- **`is_message_event(event_type)`** — whether an event type carries a message-shaped
+  `data.object`. Takes a `WebhookEventType` or a raw string, including one this SDK version
+  has never heard of.
+- **`WebhookVerificationData`** — a ready-made shape for `verification.*` payloads.
+  `parse_event()` does not produce it for you; pass it to
+  `event.object_as(WebhookVerificationData)` when you want it.
+- **An event type this SDK version does not know is delivered, not rejected.** `event.type`
+  keeps the raw string and `event.object` still carries the payload, so a new event released
+  after this version reaches your handler.
+- `WebhookEventType` gains the types that were missing everywhere: `conversation.*`,
+  `draft.*`, `rcs_brand.*`, `rcs_agent.*`, `whatsapp_account.*`, `whatsapp_template.*` and
+  `call.*`. There was previously no typed way to subscribe to RCS, WhatsApp or voice events.
+
+### Patch Changes
+
+- A `data.object` that is not a JSON object now fails with a message that says so —
+  `Failed to parse webhook payload: Invalid event structure: data.object must be an object,
+  got str` — instead of surfacing an internal `'str' object has no attribute 'get'`. It
+  raised before too; only the message changed.
+
+
+### Security
+
+- **Path parameters are percent-encoded.** Every id you pass is now encoded (`urllib.parse.quote(..., safe="")`) before it goes into the request path. An id containing `/`, `?` or `#` used to change which endpoint the request reached: an id of `../../account/keys` left its collection and hit another endpoint carrying your API key. Ordinary ids are sent byte-for-byte as before.
+
 ## 3.38.0
 
 ### Minor Changes

{sendly-3.40.0 → sendly-4.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sendly
-Version: 3.40.0
+Version: 4.0.0
 Summary: Official Sendly Python SDK for SMS messaging
 Project-URL: Homepage, https://sendly.live
 Project-URL: Documentation, https://sendly.live/docs
@@ -379,7 +379,7 @@ client.webhooks.delete('whk_xxx')
 ### Verifying Webhook Signatures
 
 ```python
-from sendly import Webhooks
+from sendly import Webhooks, WebhookSignatureError
 
 WEBHOOK_SECRET = 'your_webhook_secret'
 
@@ -392,16 +392,19 @@ def handle_webhook():
 
     try:
         event = Webhooks.parse_event(payload, signature, WEBHOOK_SECRET, timestamp=timestamp)
-
-        if event.type == 'message.delivered':
-            print(f'Message {event.data.id} delivered')
-        elif event.type == 'message.failed':
-            print(f'Message {event.data.id} failed: {event.data.error_code}')
-
-        return 'OK', 200
-    except Exception as e:
+    except WebhookSignatureError as e:
         print(f'Invalid signature: {e}')
         return 'Invalid signature', 400
+
+    if event.type == 'message.delivered':
+        print(f'Message {event.data.id} delivered')
+    elif event.type == 'message.failed':
+        print(f'Message {event.data.id} failed: {event.data.error_code}')
+    elif event.type == 'rcs_agent.live':
+        # A lifecycle event: event.data is None, the payload is on event.object
+        print(f"Agent {event.object['agent_id']} is live")
+
+    return 'OK', 200
 ```
 
 ### Reading the Event Payload
@@ -414,11 +417,15 @@ nothing the payload did not carry is added.
 `message.*` event, because RCS, WhatsApp, voice (`call.*`), 10DLC
 (`brand.*` / `campaign.*` / `assignment.*`), `number.*`, `port*`, `contact*`,
 `conversation.*`, `draft.*` and `verification.*` payloads are not
-message-shaped.
+message-shaped. `message.opt_in` and `message.opt_out` are `None` too — they
+share the prefix but carry an opt-out record (`phone_number`, `keyword`,
+`from_number`, `timestamp`), not a message.
 
 ```python
 from dataclasses import dataclass
-from sendly import Webhooks
+from typing import Optional
+
+from sendly import Webhooks, is_message_event
 
 event = Webhooks.parse_event(payload, signature, WEBHOOK_SECRET, timestamp=timestamp)
 
@@ -429,6 +436,12 @@ else:
     # lifecycle event: read the raw object
     print(event.object)
 
+# is_message_event() answers the same question from an event type alone, before
+# you have an event in hand - filtering a subscription, routing a queue
+is_message_event('message.delivered')  # True
+is_message_event('rcs_agent.live')     # False
+is_message_event('message.opt_out')    # False - an opt-out record, not a message
+
 # A contact flagged by a send failure: `id` is the contact, `message_id` is
 # the message that failed. They are never swapped.
 if event.type == 'contact.auto_flagged':
@@ -441,22 +454,35 @@ if event.type == 'call.started':
     # for PSTN legs, so treat them as optional rather than assuming either.
     caller = event.object.get('from')
 
-# Or decode into a shape of your own (dataclass, pydantic model, or dict)
+# Or decode into a shape of your own (dataclass, pydantic model, or dict).
+# Only keys the payload actually carried are passed through, so a field it did
+# not send keeps its default instead of being invented. A trailing underscore
+# maps a reserved word: `from_` reads `from`.
 @dataclass
 class AgentLive:
-    agent_id: str = None
-    name: str = None
-    stage: str = None
+    agent_id: Optional[str] = None
+    name: Optional[str] = None
+    stage: Optional[str] = None
 
 if event.type == 'rcs_agent.live':
     agent = event.object_as(AgentLive)
     print(agent.agent_id, agent.stage)
 
-raw = event.object_as()  # plain dict copy
+raw = event.object_as()      # plain dict copy
+same = event.raw_object      # alias for event.object
 ```
 
+`verification.*` payloads have a ready-made shape — pass `WebhookVerificationData` to
+`event.object_as()` rather than writing your own.
+
 Event types live in one place, `sendly.types.WebhookEventType`; `sendly.WebhookEventType`
 re-exports that enum, and `sendly.webhooks.WEBHOOK_EVENT_TYPES` is the tuple of its values.
+An event type this SDK version has not heard of is still delivered rather than rejected:
+`event.type` keeps the raw string and `event.object` still carries the payload.
+
+`message.queued` and `message.undelivered` are not in that enum. The API has never emitted
+either one and rejects both with a `400` on subscribe, so 4.0.0 removed them. `'queued'` and
+`'undelivered'` remain valid message *statuses* on `event.data.status`.
 
 ## Account & Credits
 

{sendly-3.40.0 → sendly-4.0.0}/README.md

@@ -344,7 +344,7 @@ client.webhooks.delete('whk_xxx')
 ### Verifying Webhook Signatures
 
 ```python
-from sendly import Webhooks
+from sendly import Webhooks, WebhookSignatureError
 
 WEBHOOK_SECRET = 'your_webhook_secret'
 
@@ -357,16 +357,19 @@ def handle_webhook():
 
     try:
         event = Webhooks.parse_event(payload, signature, WEBHOOK_SECRET, timestamp=timestamp)
-
-        if event.type == 'message.delivered':
-            print(f'Message {event.data.id} delivered')
-        elif event.type == 'message.failed':
-            print(f'Message {event.data.id} failed: {event.data.error_code}')
-
-        return 'OK', 200
-    except Exception as e:
+    except WebhookSignatureError as e:
         print(f'Invalid signature: {e}')
         return 'Invalid signature', 400
+
+    if event.type == 'message.delivered':
+        print(f'Message {event.data.id} delivered')
+    elif event.type == 'message.failed':
+        print(f'Message {event.data.id} failed: {event.data.error_code}')
+    elif event.type == 'rcs_agent.live':
+        # A lifecycle event: event.data is None, the payload is on event.object
+        print(f"Agent {event.object['agent_id']} is live")
+
+    return 'OK', 200
 ```
 
 ### Reading the Event Payload
@@ -379,11 +382,15 @@ nothing the payload did not carry is added.
 `message.*` event, because RCS, WhatsApp, voice (`call.*`), 10DLC
 (`brand.*` / `campaign.*` / `assignment.*`), `number.*`, `port*`, `contact*`,
 `conversation.*`, `draft.*` and `verification.*` payloads are not
-message-shaped.
+message-shaped. `message.opt_in` and `message.opt_out` are `None` too — they
+share the prefix but carry an opt-out record (`phone_number`, `keyword`,
+`from_number`, `timestamp`), not a message.
 
 ```python
 from dataclasses import dataclass
-from sendly import Webhooks
+from typing import Optional
+
+from sendly import Webhooks, is_message_event
 
 event = Webhooks.parse_event(payload, signature, WEBHOOK_SECRET, timestamp=timestamp)
 
@@ -394,6 +401,12 @@ else:
     # lifecycle event: read the raw object
     print(event.object)
 
+# is_message_event() answers the same question from an event type alone, before
+# you have an event in hand - filtering a subscription, routing a queue
+is_message_event('message.delivered')  # True
+is_message_event('rcs_agent.live')     # False
+is_message_event('message.opt_out')    # False - an opt-out record, not a message
+
 # A contact flagged by a send failure: `id` is the contact, `message_id` is
 # the message that failed. They are never swapped.
 if event.type == 'contact.auto_flagged':
@@ -406,22 +419,35 @@ if event.type == 'call.started':
     # for PSTN legs, so treat them as optional rather than assuming either.
     caller = event.object.get('from')
 
-# Or decode into a shape of your own (dataclass, pydantic model, or dict)
+# Or decode into a shape of your own (dataclass, pydantic model, or dict).
+# Only keys the payload actually carried are passed through, so a field it did
+# not send keeps its default instead of being invented. A trailing underscore
+# maps a reserved word: `from_` reads `from`.
 @dataclass
 class AgentLive:
-    agent_id: str = None
-    name: str = None
-    stage: str = None
+    agent_id: Optional[str] = None
+    name: Optional[str] = None
+    stage: Optional[str] = None
 
 if event.type == 'rcs_agent.live':
     agent = event.object_as(AgentLive)
     print(agent.agent_id, agent.stage)
 
-raw = event.object_as()  # plain dict copy
+raw = event.object_as()      # plain dict copy
+same = event.raw_object      # alias for event.object
 ```
 
+`verification.*` payloads have a ready-made shape — pass `WebhookVerificationData` to
+`event.object_as()` rather than writing your own.
+
 Event types live in one place, `sendly.types.WebhookEventType`; `sendly.WebhookEventType`
 re-exports that enum, and `sendly.webhooks.WEBHOOK_EVENT_TYPES` is the tuple of its values.
+An event type this SDK version has not heard of is still delivered rather than rejected:
+`event.type` keeps the raw string and `event.object` still carries the payload.
+
+`message.queued` and `message.undelivered` are not in that enum. The API has never emitted
+either one and rejects both with a `400` on subscribe, so 4.0.0 removed them. `'queued'` and
+`'undelivered'` remain valid message *statuses* on `event.data.status`.
 
 ## Account & Credits
 

{sendly-3.40.0 → sendly-4.0.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sendly"
-version = "3.40.0"
+version = "4.0.0"
 description = "Official Sendly Python SDK for SMS messaging"
 readme = "README.md"
 license = "MIT"

{sendly-3.40.0 → sendly-4.0.0}/sendly/__init__.py

@@ -29,7 +29,7 @@ Async Example:
     >>> asyncio.run(main())
 """
 
-__version__ = "3.40.0"
+__version__ = "4.0.0"
 
 # Main clients
 from .client import AsyncSendly, Sendly

{sendly-3.40.0 → sendly-4.0.0}/sendly/resources/account.py

@@ -8,6 +8,7 @@ from typing import Any, Dict, List, Optional
 
 from ..types import Account, ApiKey, Credits, CreditTransaction
 from ..utils.http import AsyncHttpClient, HttpClient
+from urllib.parse import quote
 
 
 def _transform_response(data: Dict[str, Any], key_map: Dict[str, str]) -> Dict[str, Any]:
@@ -141,7 +142,7 @@ class AccountResource:
         Returns:
             API key details
         """
-        response = self._http.request("GET", f"/account/keys/{key_id}")
+        response = self._http.request("GET", f"/account/keys/{quote(key_id, safe='')}")
         return ApiKey(**_transform_response(response, API_KEY_MAP))
 
     def get_api_key_usage(self, key_id: str) -> Dict[str, Any]:
@@ -154,7 +155,7 @@ class AccountResource:
         Returns:
             Usage statistics
         """
-        response = self._http.request("GET", f"/account/keys/{key_id}/usage")
+        response = self._http.request("GET", f"/account/keys/{quote(key_id, safe='')}/usage")
         return response
 
     def create_api_key(self, name: str, expires_at: Optional[str] = None) -> Dict[str, Any]:
@@ -192,7 +193,7 @@ class AccountResource:
         if not key_id:
             raise ValueError("API key ID is required")
 
-        self._http.request("PATCH", f"/account/keys/{key_id}/revoke", body={})
+        self._http.request("PATCH", f"/account/keys/{quote(key_id, safe='')}/revoke", body={})
 
     def rotate_api_key(
         self, key_id: str, grace_period_hours: Optional[int] = None
@@ -228,7 +229,7 @@ class AccountResource:
                 raise ValueError("grace_period_hours must be between 24 and 168")
             body["gracePeriodHours"] = grace_period_hours
 
-        return self._http.request("POST", f"/account/keys/{key_id}/rotate", body=body)
+        return self._http.request("POST", f"/account/keys/{quote(key_id, safe='')}/rotate", body=body)
 
 
 class AsyncAccountResource:
@@ -284,12 +285,12 @@ class AsyncAccountResource:
 
     async def get_api_key(self, key_id: str) -> ApiKey:
         """Get a specific API key by ID."""
-        response = await self._http.request("GET", f"/account/keys/{key_id}")
+        response = await self._http.request("GET", f"/account/keys/{quote(key_id, safe='')}")
         return ApiKey(**_transform_response(response, API_KEY_MAP))
 
     async def get_api_key_usage(self, key_id: str) -> Dict[str, Any]:
         """Get usage statistics for an API key."""
-        response = await self._http.request("GET", f"/account/keys/{key_id}/usage")
+        response = await self._http.request("GET", f"/account/keys/{quote(key_id, safe='')}/usage")
         return response
 
     async def create_api_key(self, name: str, expires_at: Optional[str] = None) -> Dict[str, Any]:
@@ -323,7 +324,7 @@ class AsyncAccountResource:
         if not key_id:
             raise ValueError("API key ID is required")
 
-        await self._http.request("PATCH", f"/account/keys/{key_id}/revoke", body={})
+        await self._http.request("PATCH", f"/account/keys/{quote(key_id, safe='')}/revoke", body={})
 
     async def rotate_api_key(
         self, key_id: str, grace_period_hours: Optional[int] = None
@@ -355,5 +356,5 @@ class AsyncAccountResource:
             body["gracePeriodHours"] = grace_period_hours
 
         return await self._http.request(
-            "POST", f"/account/keys/{key_id}/rotate", body=body
+            "POST", f"/account/keys/{quote(key_id, safe='')}/rotate", body=body
         )

{sendly-3.40.0 → sendly-4.0.0}/sendly/resources/campaigns.py

@@ -10,6 +10,7 @@ from ..types import (
     CampaignPreview,
 )
 from ..utils.http import AsyncHttpClient, HttpClient
+from urllib.parse import quote
 
 
 class CampaignsResource:
@@ -91,7 +92,7 @@ class CampaignsResource:
 
     def get(self, campaign_id: str) -> Campaign:
         """Get a campaign by ID"""
-        data = self._http.request("GET", f"/campaigns/{campaign_id}")
+        data = self._http.request("GET", f"/campaigns/{quote(campaign_id, safe='')}")
         return self._transform_campaign(data)
 
     def update(
@@ -114,19 +115,19 @@ class CampaignsResource:
         if contact_list_ids is not None:
             body["contactListIds"] = contact_list_ids
 
-        data = self._http.request("PATCH", f"/campaigns/{campaign_id}", body=body)
+        data = self._http.request("PATCH", f"/campaigns/{quote(campaign_id, safe='')}", body=body)
         return self._transform_campaign(data)
 
     def delete(self, campaign_id: str) -> None:
         """Delete a campaign (draft or cancelled only)"""
-        self._http.request("DELETE", f"/campaigns/{campaign_id}")
+        self._http.request("DELETE", f"/campaigns/{quote(campaign_id, safe='')}")
 
     def preview(self, campaign_id: str) -> CampaignPreview:
         """Preview campaign before sending
 
         Returns recipient count, credit estimate, and breakdown.
         """
-        data = self._http.request("GET", f"/campaigns/{campaign_id}/preview")
+        data = self._http.request("GET", f"/campaigns/{quote(campaign_id, safe='')}/preview")
         return CampaignPreview(
             id=data["id"],
             recipient_count=data["recipient_count"],
@@ -139,7 +140,7 @@ class CampaignsResource:
 
     def send(self, campaign_id: str) -> Campaign:
         """Send a campaign immediately"""
-        data = self._http.request("POST", f"/campaigns/{campaign_id}/send")
+        data = self._http.request("POST", f"/campaigns/{quote(campaign_id, safe='')}/send")
         return self._transform_campaign(data)
 
     def schedule(
@@ -159,17 +160,17 @@ class CampaignsResource:
         if timezone:
             body["timezone"] = timezone
 
-        data = self._http.request("POST", f"/campaigns/{campaign_id}/schedule", body=body)
+        data = self._http.request("POST", f"/campaigns/{quote(campaign_id, safe='')}/schedule", body=body)
         return self._transform_campaign(data)
 
     def cancel(self, campaign_id: str) -> Campaign:
         """Cancel a scheduled campaign"""
-        data = self._http.request("POST", f"/campaigns/{campaign_id}/cancel")
+        data = self._http.request("POST", f"/campaigns/{quote(campaign_id, safe='')}/cancel")
         return self._transform_campaign(data)
 
     def clone(self, campaign_id: str) -> Campaign:
         """Clone a campaign (creates new draft)"""
-        data = self._http.request("POST", f"/campaigns/{campaign_id}/clone")
+        data = self._http.request("POST", f"/campaigns/{quote(campaign_id, safe='')}/clone")
         return self._transform_campaign(data)
 
     def _transform_campaign(self, data: Dict[str, Any]) -> Campaign:
@@ -245,7 +246,7 @@ class AsyncCampaignsResource:
 
     async def get(self, campaign_id: str) -> Campaign:
         """Get a campaign by ID"""
-        data = await self._http.request("GET", f"/campaigns/{campaign_id}")
+        data = await self._http.request("GET", f"/campaigns/{quote(campaign_id, safe='')}")
         return self._transform_campaign(data)
 
     async def update(
@@ -268,16 +269,16 @@ class AsyncCampaignsResource:
         if contact_list_ids is not None:
             body["contactListIds"] = contact_list_ids
 
-        data = await self._http.request("PATCH", f"/campaigns/{campaign_id}", body=body)
+        data = await self._http.request("PATCH", f"/campaigns/{quote(campaign_id, safe='')}", body=body)
         return self._transform_campaign(data)
 
     async def delete(self, campaign_id: str) -> None:
         """Delete a campaign (draft or cancelled only)"""
-        await self._http.request("DELETE", f"/campaigns/{campaign_id}")
+        await self._http.request("DELETE", f"/campaigns/{quote(campaign_id, safe='')}")
 
     async def preview(self, campaign_id: str) -> CampaignPreview:
         """Preview campaign before sending"""
-        data = await self._http.request("GET", f"/campaigns/{campaign_id}/preview")
+        data = await self._http.request("GET", f"/campaigns/{quote(campaign_id, safe='')}/preview")
         return CampaignPreview(
             id=data["id"],
             recipient_count=data["recipient_count"],
@@ -290,7 +291,7 @@ class AsyncCampaignsResource:
 
     async def send(self, campaign_id: str) -> Campaign:
         """Send a campaign immediately"""
-        data = await self._http.request("POST", f"/campaigns/{campaign_id}/send")
+        data = await self._http.request("POST", f"/campaigns/{quote(campaign_id, safe='')}/send")
         return self._transform_campaign(data)
 
     async def schedule(
@@ -304,17 +305,17 @@ class AsyncCampaignsResource:
         if timezone:
             body["timezone"] = timezone
 
-        data = await self._http.request("POST", f"/campaigns/{campaign_id}/schedule", body=body)
+        data = await self._http.request("POST", f"/campaigns/{quote(campaign_id, safe='')}/schedule", body=body)
         return self._transform_campaign(data)
 
     async def cancel(self, campaign_id: str) -> Campaign:
         """Cancel a scheduled campaign"""
-        data = await self._http.request("POST", f"/campaigns/{campaign_id}/cancel")
+        data = await self._http.request("POST", f"/campaigns/{quote(campaign_id, safe='')}/cancel")
         return self._transform_campaign(data)
 
     async def clone(self, campaign_id: str) -> Campaign:
         """Clone a campaign (creates new draft)"""
-        data = await self._http.request("POST", f"/campaigns/{campaign_id}/clone")
+        data = await self._http.request("POST", f"/campaigns/{quote(campaign_id, safe='')}/clone")
         return self._transform_campaign(data)
 
     def _transform_campaign(self, data: Dict[str, Any]) -> Campaign: