What changed in the Twilio API

In Spain and France, an incoming call intended for a non-Spanish or non-French destination that is then forwarded internationally while presenting a Spanish or French domestic caller ID is now blocked

Twilio Elastic SIP Trunking logo
International Call Forwarding - Compliance Blocking for Spain & France 
 In Spain and France, an incoming call intended for a non-Spanish or non-French destination that is then forwarded internationally while presenting a Spanish or French domestic caller ID is now blocked, in line with local regulatory requirements. 

Upgrade to Java Helper Library 13.0.0 or later as soon as possible. Version 13 does include breaking changes so follow the

Verify Custom Templates are now Generally Available
 give you the flexibility and security to use custom SMS/RCS and Voice message templates beyond standard 
defaults or pre-approved options
To learn more about how to create a custom template for your business needs, check out our 
Critical fix: Java Helper Library 13.0.0: fixes crash on unknown fields in nested API responses
The Java Helper Library now handles unknown fields gracefully in nested response objects, but if customers are on an affected version, their integration is at risk until they upgrade.
Versions 10.0.0 through 12.1.1 parse nested response types (profile, configuration, webhook, and others) with strict deserialization. When an API response comes back with a field the SDK doesn't recognize, the request fails with ApiConnectionException: Unable to deserialize response: Unrecognized field. Because Twilio APIs can add new optional fields at any time, this is a latent break. Customers’ integrations work today and can start failing without warning the moment a new field ships.
In 13.0.0, the Java Helper Library ignores unknown fields in all response objects, matching how every other Twilio Helper Library already behave

Twilio SendGrid has added automatic SSL certificate provisioning as a toggle within the standard link branding setup flow. When enabled, SendGrid provisions and hosts the SSL certificate needed to ser

Update to Twilio SendGrid Link Branding: Automatic SSL Certificate Provisioning
Twilio SendGrid has added automatic SSL certificate provisioning as a toggle within the standard link branding setup flow. When enabled, SendGrid provisions and hosts the SSL certificate needed to serve tracking and branded links over HTTPS, removing the need to purchase, install, and maintain a certificate through an external CDN or DNS provider.
Twilio SendGrid recommends activating this setting for all link branding domains. Gmail is rolling out warnings on non-HTTPS links by the end of October 2026, and tracking links without SSL will see reduced click-through as a result. Enabling automatic SSL requires adding two additional DNS records provided by SendGrid, alongside the CNAME records already used for link branding.
The Link Branding API now supports a new auto_ssl parameter when creating a branded link. Setting auto_ssl to true provisions the certificate automatically, returns the additional DNS records needed to complete setup, and reports certificate status through a new auto_ssl_available field once the certificate is issued and live. auto_ssl can only be set when a link is created and can't b

Twilio has observed  a sudden rise in SMS Pumping fraud (aka SMS Artificially Inflated Traffic) targeting messages to Italy (IT) and Argentina (AR). To protect customers from this activity, Twilio Ver

Verify tightens fraud prevention geo permissions for Italy and Argentina
Twilio has observed  a sudden rise in SMS Pumping fraud (aka SMS Artificially Inflated Traffic) targeting messages to Italy (IT) and Argentina (AR). To protect customers from this activity, Twilio Verify is tightening its fraud prevention posture for these two countries, effective August 19, 2026.
Specifically, Twilio is  updating the default Verify Geo Permissions setting for Italy and Argentina from "Allow all traffic" — the default state at account creation — to "Monitor all traffic for fraud." This change applies to all existing  accounts where IT and/or AR remain in  the default "Allow all traffic" state.
What this means for customers
If your account still has IT and/or AR set to the default 
 permission, it will be updated to 
"Monitor all traffic for fraud"
 starting August 19, 2026.
If you've already changed the geo permission for IT or AR away from the default “Allow all traffic” (to any other state), your configuration will not be modified by this update.
The protection provided by "Monitor all traffic for fraud" requires that you have Fraud Guard enabled. 
No action is required for customers with Fr

Customers can now send Content Templates to many recipients at once and personalize the template for each recipient using the Bulk Messaging API. This update enhances and simplifies sending notificati

Bulk Messaging Supports WhatsApp Content Templates
Customers can now send Content Templates to many recipients at once and personalize the template for each recipient using the Bulk Messaging API. This update enhances and simplifies sending notifications and marketing messages campaigns. With Bulk Messaging's configurable fallback, this release also enables new fallback strategies including WhatsApp to SMS and RCS to WhatsApp. 

Functions Classic is being deprecated and existing Functions (Classic) are moving to the new Functions

Functions Classic is being deprecated and existing Functions (Classic) are moving to the new Functions
Twilio is retiring Functions Classic and automatically migrating all accounts to the new Functions. No action is required from customers. 
What's changing with Twilio Functions
Starting September 13, 2026, customers won’t be able to create new Functions (Classic) and assets. Existing Functions (Classic) and assets will continue running, and customers can still edit and deploy existing code during this window.
Between September 14 and October 26, 2026, Twilio will migrate all active Functions (Classic), existing URLs, function and asset names, environment variables, and deployed code to the new Functions. 
These resources will help:
Migrating from Functions (Classic) to the new Functions Editor
Upgrading Node.js for Twilio Functions

Consent Management API Now Supports Toll-Free Network-Level Opt-Out Overrides

Consent Management API Now Supports Toll-Free Network-Level Opt-Out Overrides
Customers can now use the Consent Management API to programmatically re-opt-in users on US and Canada Toll-Free numbers.
Previously, opt-outs on US/CA Toll free numbers were strictly enforced at the network level, meaning an opt out block could only be lifted if the user texted an opt-in keyword like "START". Now, if a user provides valid re-opt-in consent outside of a messaging channel (e.g., via a web form, email, or in-app preference center), you can log their updated consent directly through the Consent Management API. Twilio will automatically pass this signal to downstream networks to clear the opt-out block and resume messaging.
Programmatic Re-Opt-In: Seamlessly restore message deliverability for users who re-consent via external channels.
Fewer Failed Sends: Eliminate 
(Unsubscribed Recipient) and 
 (Message Blocked) error codes for users who have re-consented to receive messages.
Centralized Compliance: Keep your Twilio messaging traffic perfectly synced with your CRM and internal omnichannel engagement and consent workflows.
For more information, see our 
Consent Management API docs
Twilio end-

On September 15, 2026, Twilio will add new error codes for Toll-Free Verification and A2P 10DLC campaign registration rejections.

New error codes provide clearer TFV and A2P 10DLC registration feedback launching September 15, 2026
On September 15, 2026, Twilio will add new error codes for Toll-Free Verification and A2P 10DLC campaign registration rejections. 

Currently, these fields return values shifted forward by the Pacific Standard Time time zone offset (+7 hours) despite the Z suffix indicating UTC. This is a presentation-layer bug introduced in 2023;

 <path class="icon-stroke" d="M75.3037 3.98207L3 75.5935M75.3037 3.98207L76.0435 43.3021M75.3037 3.98207L35.951 3.59351" stroke="#F22F46" stroke-width="5.5" stroke-linecap="round" stroke-linejoin="round"/>
 <path class="icon-stroke" d="M75.3037 3.98207L3 75.5935M75.3037 3.98207L76.0435 43.3021M75.3037 3.98207L35.951 3.59351" stroke="#F22F46" stroke-width="5.5" stroke-linecap="round" stroke-linejoin="round"/>
 <path class="icon-stroke" d="M75.3037 3.98207L3 75.5935M75.3037 3.98207L76.0435 43.3021M75.3037 3.98207L35.951 3.59351" stroke="#F22F46" stroke-width="5.5" stroke-linecap="round" stroke-linejoin="round"/>
 <path class="icon-stroke" d="M75.3037 3.98207L3 75.5935M75.3037 3.98207L76.0435 43.3021M75.3037 3.98207L35.951 3.59351" stroke="#F22F46" stroke-width="5.5" stroke-linecap="round" stroke-linejoin="round"/>
 <path class="icon-stroke" d="M75.3037 3.98207L3 75.5935M75.3037 3.98207L76.0435 43.3021M75.3037 3.98207L35.951 3.59351" stroke="#F22F46" stroke-width="5.5" stroke-linecap="round" stroke-linejoin="round"/>
 <path class="icon-stroke" d="M75.3037 3.98207L3 75.5935M75.3037 3.98207L76.0435 43.3021M75.3037 3.98207L35.951 3.59351" stroke="#F22F46" stroke-width="5.5" stroke-lineca

Twilio is introducing a new regional IP address for Event Streams webhook traffic in US East (us-east-1). This is part of a move from a single shared IP range to dedicated regional addresses, bringi

Twilio Event Streams logo
New Regional IP Address for Event Streams Webhooks in US East
, Twilio is introducing a new regional IP address for Event Streams webhook traffic in US East (us-east-1). This is part of a move from a single shared IP range to dedicated regional addresses, bringing Event Streams in line with how the rest of the Twilio platform routes traffic.
This change only affects customers who validate incoming Event Streams webhook traffic by source IP address. If a setup doesn’t check the source IP, no action is needed.
What’s changing with Event Streams IP addresses?
The new subnet for US East is 3.80.20.0/25, covering the range 3.80.20.0 – 3.80.20.127.
Customers who do validate by source IP can add the new US East range to their allowlist on September 15, 2026. The existing shared range (35.90.102.128/25) will remain active alongside the new addresses for now. Twilio will publish a follow-up changelog entry when it’s safe to remove the legacy range.
Additional regional IP addresses for other Twilio Regions will be shared as they become available.
Event Streams webhook security documentation
Twilio Editions static proxy IP addresses

Update to SendGrid Domain Authentication: Send to Coworker Action Removed

Twilio SendGrid Email API logo
Update to SendGrid Domain Authentication: Send to Coworker Action Removed
Effective August 3, 2026, Twilio SendGrid has removed the Send to Coworker action from the Domain Authentication setup flow due to low usage. This simplification prioritizes only the most valuable paths for users to complete their domain authentication and get started with email.
Directing DNS records through automated email is no longer the optimal method for technical handoffs. DNS configurations are highly sensitive to formatting, and transferring this data via email can increase the risk of errors during the setup process. This change ensures that critical security records are managed through more intentional and reliable methods.
For users of the Send to Coworker action, Twilio SendGrid recommends reaching out directly to your IT or infrastructure teams via internal communication channels, such as Slack, Microsoft Teams, or internal ticketing systems. Sending DNS record update requests through internal communication channels ensures recipients trust the request. Utilizing these established workflows also delivers the necessary context and data in a format that aligns with a