Récemment livré.

Two parts of SMS that were dashboard-only are now on the public API, with typed SDK methods, bird CLI commands, and MCP tools for each.

Getting started

• SMS stats API
• Opt-outs and keywords

What's available

• Statistics: the aggregate summary, the daily and hourly series, and breakdowns by destination country, carrier, originator, category, status, and failure reason, plus counts of what your numbers received, by country, operator, and number. The same aggregation the Metrics dashboard reads.
• Suppressions: list who your senders may not message and why, check one subscriber before sending to them, and add or end a suppression of your own. A send to a suppressed pair is refused with SMSRecipientSuppressed rather than going out.
• Message timeline: a message's lifecycle events are now a public read, alongside the message itself.
• Everywhere you build: the API, the Go, TypeScript, Python, and PHP SDKs, bird sms stats, bird sms suppressions, and bird sms list-events on the CLI, and the matching MCP tools.

You can now send SIP over TCP to port 5060, the same port UDP already uses. TCP used to have a port of its own, 5062, which meant every TCP setup had to be told about it explicitly.

Nothing breaks if you are already on 5062: it still accepts TCP calls, so equipment pointed at it keeps working and needs no change. Use 5060 for anything you set up from now on.

TLS is unchanged on 5061.

SMS had one scope. A key that could send a message could also delete a suppression, change a sender, edit the destination allowlist, and file a 10DLC registration. There was no way to hand someone SMS configuration without also handing them the ability to send, and no way to give support read-only access without write.

That splits today, the way Email and WhatsApp already did. sms keeps sending and the message log. Everything that configures the channel moves to a new sms_management scope.

What moves

sms_management now covers senders and their country registrations, 10DLC brands and campaigns, toll-free verification, suppressions, keyword replies, the destination allowlist, and templates.

sms keeps POST /v1/sms/messages, the batch send, the message log and its events, and SMS statistics.

Both scopes take read and write, and every built-in role holds the same level on both, so nothing changes for people in the dashboard. Admins and developers manage SMS as before; analysts still read it.

If you call these from an API key

Four operations change what they require, and existing keys are affected. GET /v1/sms/templates, GET /v1/sms/templates/{template_ref}, GET /v1/sms/destinations and PUT /v1/sms/destinations now need sms_management and return 403 for a key holding only sms. The same applies to bird sms templates and bird sms destinations on the CLI, and to the matching MCP tools.

A key's scopes are fixed when it is issued and cannot be changed, so the fix is a new key. Create one with both sms and sms_management from Developers → API keys, swap it in, and revoke the old one. On the CLI, bird login again: a fresh token carries sms_management:read.

The other management endpoints are reachable only from the dashboard, which already carries the new scope.

Granting less

The point of the split is the key you can now mint. A service that only sends holds sms:write and cannot touch a suppression. A support tool that reads senders and registrations holds sms_management:read and can send nothing. Grant the narrowest pair that works.

Verify now delivers one-time passcodes over Telegram, alongside email, SMS, and WhatsApp. The channel is available in every country and sits after WhatsApp and SMS but before email, so no verification changes the channel it starts on. Where a recipient has both a phone number and an email address, Telegram is now tried before the email fallback. If you have pinned a channel order for a country, Telegram joins the end of that pin instead, until you save a new order placing it where you want it.

Codes arrive from Telegram's own verified notification account. There is no Bird sender and no sender of your own to configure, which is a property of the Telegram Gateway rather than something still to come. A number is checked for whether it can receive a Telegram message before one is sent, and where it cannot, the verification moves to the next channel without a message going out.

Using it

Nothing is required to turn it on. To reach Telegram earlier for a given country, reorder that country's channels in country configuration, or name the order per request with options.channels on POST /v1/verify/verifications. telegram is a valid channel name everywhere a channel name is accepted.

One thing to check if you call the API directly

A per-country channel order must name every channel available in that country. Telegram has now joined that set, so orders you saved before this release keep working, but re-submitting one is rejected with a 422 until you add telegram to it. Reading the country's current channels and submitting them back is enough. The dashboard handles this for you.

The email Metrics page (Email → Metrics) now splits into an Outbound tab, everything you send, and a new Inbound tab covering what your workspace receives. Inbound shows a Messages received count for the selected range plus a volume-over-time chart, once you've set up a forward address or your own domain for receiving. See email metrics.

Also in this release:

• New guide: SMS character limits lays out GSM-7 versus UCS-2 encoding, which characters (curly quotes, emoji, the euro sign and other extension-table characters) push a message into the pricier alphabet or eat two character slots, and the 12-segment cap on a single send.