Recently shipped.

The numbers your workspace sends from are now yours to manage over the API. Search what is on sale in a country, order one, and release it when you are done, without opening the dashboard.

Buying a number was a dashboard task, which meant provisioning could not be part of anything automated: onboarding a customer onto their own number, or giving a new region its own local presence, ended at a form somebody had to fill in. These are the same operations the dashboard has been using, now published.

What's new

• Search, scoped to a country. GET /v1/numbers/available takes a country_code and narrows from there by type, capability, or a prefix of national digits. Bird's own stock pages normally; the last page can include what a carrier is offering live.
• Buying is an order you can follow. POST /v1/numbers/orders usually completes inside the request and hands back the number. One that has to wait on a carrier comes back still running, and GET /v1/numbers/orders/{order_id} polls it to completed or failed. Send an Idempotency-Key and a retry cannot buy twice.
• Read and release what is allocated to you. GET /v1/numbers lists your numbers with their type, capabilities, and status; DELETE /v1/numbers/{number_id} releases a dedicated one and stops its monthly charge.
• Typed in every SDK. numbers.available.list, numbers.orders.create, numbers.list and numbers.release are methods in the Go, TypeScript, Python, and PHP SDKs, each with a worked example.

An API key needs the new numbers scope, and the first purchase in an organization needs identity verification. Buy and release a number walks the whole flow, and Numbers overview explains what the fields on a number mean.

Keyword configuration is now open to every workspace, and on the public API alongside it.

Bird has always recognised and honoured a STOP on your numbers with no setup on your side, and that has not changed. What is new is that you can see exactly which keywords it recognises where, and make the replies say your name instead of ours.

Getting started

• Opt-outs and keywords

What's available

• See what applies: list the rules for a country, or for one of your numbers in the order they are applied, including what a sender messaging from elsewhere gets.
• Replace a reply: override Bird's opt-out, opt-in, or help wording for a country. Your rule keeps Bird's keywords unless you add more, including keywords Bird adds later, so your compliance answer does not go stale.
• Campaign keywords: add custom keywords of your own with the reply you write.
• Answer from your own system: switch Bird's auto-reply off for a rule while the opt-out itself keeps being honoured.
• Everywhere you build: the dashboard, the API, the Go, TypeScript, Python, and PHP SDKs, bird sms keyword-rules on the CLI, and the matching MCP tools.

What an opt-out or opt-in keyword does is fixed and cannot be reassigned. Coverage is per country: listing the rules for a country shows what is recognised there, and where nothing is, no keyword is matched and no opt-out is recorded, so you are responsible for honouring opt-outs there yourself.

Two parts of SMS that were dashboard-only are now on the public API, with typed SDK methods, bird CLI commands, and MCP tools for each.

Getting started

• SMS stats API
• Opt-outs and keywords

What's available

• Statistics: the aggregate summary, the daily and hourly series, and breakdowns by destination country, carrier, originator, category, status, and failure reason, plus counts of what your numbers received, by country, operator, and number. The same aggregation the Metrics dashboard reads.
• Suppressions: list who your senders may not message and why, check one subscriber before sending to them, and add or end a suppression of your own. A send to a suppressed pair is refused with SMSRecipientSuppressed rather than going out.
• Message timeline: a message's lifecycle events are now a public read, alongside the message itself.
• Everywhere you build: the API, the Go, TypeScript, Python, and PHP SDKs, bird sms stats, bird sms suppressions, and bird sms list-events on the CLI, and the matching MCP tools.

You can now send SIP over TCP to port 5060, the same port UDP already uses. TCP used to have a port of its own, 5062, which meant every TCP setup had to be told about it explicitly.

Nothing breaks if you are already on 5062: it still accepts TCP calls, so equipment pointed at it keeps working and needs no change. Use 5060 for anything you set up from now on.

TLS is unchanged on 5061.

For current setup, see the SIP trunk transport and connection settings.

SMS had one scope. A key that could send a message could also delete a suppression, change a sender, edit the destination allowlist, and file a 10DLC registration. There was no way to hand someone SMS configuration without also handing them the ability to send, and no way to give support read-only access without write.

That splits today, the way Email and WhatsApp already did. sms keeps sending and the message log. Everything that configures the channel moves to a new sms_management scope.

What moves

sms_management now covers senders and their country registrations, 10DLC brands and campaigns, toll-free verification, suppressions, keyword replies, the destination allowlist, and templates.

sms keeps POST /v1/sms/messages, the batch send, the message log and its events, and SMS statistics.

Both scopes take read and write, and every built-in role holds the same level on both, so nothing changes for people in the dashboard. Admins and developers manage SMS as before; analysts still read it.

If you call these from an API key

Four operations change what they require, and existing keys are affected. GET /v1/sms/templates, GET /v1/sms/templates/{template_ref}, GET /v1/sms/destinations and PUT /v1/sms/destinations now need sms_management and return 403 for a key holding only sms. The same applies to bird sms templates and bird sms destinations on the CLI, and to the matching MCP tools.

A key's scopes are fixed when it is issued and cannot be changed, so the fix is a new key. Create one with both sms and sms_management from Developers → API keys, swap it in, and revoke the old one. On the CLI, bird login again: a fresh token carries sms_management:read.

The other management endpoints are reachable only from the dashboard, which already carries the new scope.

Granting less

The point of the split is the key you can now mint. A service that only sends holds sms:write and cannot touch a suppression. A support tool that reads senders and registrations holds sms_management:read and can send nothing. Grant the narrowest pair that works.