mTLS for API requests and webhook deliveries

Bird introduces mTLS, available on request, for both directions of a connection.

For API requests, add your certificate authority's public certificate in Workspace settings → mTLS (or POST /v1/workspace/mtls-certificate-authorities), then send requests to the new mtls.<region>.platform.bird.com endpoint with a client certificate. Run in evaluating mode while you move traffic over, then switch to enforced so the standard endpoint stops accepting API key and service account requests entirely.

For webhook deliveries, Bird generates a key pair and a certificate signing request under Webhooks → mTLS, your certificate authority signs it, and Bird presents the signed certificate whenever your receiver asks for one during the TLS handshake. POST /v1/webhooks/{webhook_id}/test now returns a client_certificate field (presented, not_requested, or rejected) so you can confirm your receiver is checking it correctly before enforcing.

Both directions support certificate revocation checks against a certificate's CRL, and a required subject alternative name for API requests when your certificate authority also issues to other parties. See the mTLS guide for setup, rotation, and troubleshooting.

Also in this release:

• WhatsApp templates can set a delivery time-to-live. message_send_ttl_seconds on a template language controls how long WhatsApp keeps trying before dropping an undelivered message, from 30 seconds up to 30 days depending on category. See Upsert WhatsApp template language.
• Workspace quotas report their type. GET /v1/workspace/quotas now returns type (integer or boolean) and label alongside each quota, so a feature-switch quota no longer reports a misleading unit.
• Callback signing secrets now cover voice sequence webhooks. Rotating your workspace's signing secret at POST /v1/webhook-callbacks/rotate-signing-secret re-signs both SMS callback URLs and voice sequence webhook requests, which now share one secret.