Release MR130

Template

get_template_data_field_list
update_template_data_field_list
get_template_group_field_list
update_template_group_field_list

Marked "i_format_type" as readonly in TemplateDataFieldInfo and TemplateGroupFieldInfo. The field is still returned in responses but is no longer accepted on update — it is now derived from "i_format".

Values sent in this field on update are silently ignored.

Notification

update_notification_template

Removed "i_format_type" from the variables array in input. The value was redundant and is now derived from "i_format".

Stop sending "i_format_type" in the variables array — only "i_format" is needed.

Service

update_service

It's possible to set i_tax_transaction_code value for predefined (system) services

Session

login

A new credential pair (login, one_time_password) is now accepted from the customer and account realms — the one-time-password authenticates the user directly, without a static password. Available only from IP addresses listed in the Security.AllowLoginByOTPFrom configuration option. When the one-time-password was issued with a specific domain, the login request must originate from the same domain, otherwise it is rejected. When the user has multi-factor authentication configured, the returned session still requires 2FA confirmation before it can be used.

AccessControl

create_otp

Two optional inputs added: "otp_domain" binds the issued one-time-password to a domain (the default OTP notification templates append a trailing "@<otp_domain> #<password>" line so mobile clients can auto-fill the code, and a subsequent Session/login that uses this OTP is accepted only when the request originates from the same domain), and "skip_auth" (when set to 1) binds the OTP to the target entity instead of the caller's session, so the entity itself can later consume it via Session/login (the call must originate from an IP listed in the Security.AllowLoginByOTPFrom configuration option). The "notification_type" input is no longer mandatory — it may be omitted when an ESPF handler for the new Notification/PlatformManagement/OTPVerificationCode event is enabled, in which case the OTP is delivered via ESPF only.

Generic

get_config_data

Removed:

• Web.UseNewInterfaceForReseller
• Web.UseNewInterfaceForDistributor

Vendor

add_vendor
add_vendor_advanced
update_vendor
get_vendor_info
get_vendor_list

Removed:

• i_acl

• login

• password

• in_date_format, in_time_format

• out_date_format, out_time_format, out_date_time_format

• password_lifetime (for get_vendor_info)

Product

clone_product

Added optional input field "end_user_name" — sets the user-visible product name on the cloned product. When omitted, the new product retains the prior behavior: admin-realm clones inherit "end_user_name" from the parent product, reseller-realm clones default it to the new product "name".

Generic

get_config_data

Config options was extended with Customers.AllowedCleanupPeriod

Account, Customer

Account.get_emergency_details,
Customer.get_emergency_details,
Customer.get_customer_site_emergency_details

New read-only methods that return Bandwidth E911 emergency endpoint details (caller name and address) for an account, customer, or customer site.

TTS

get_capabilities

get_voice_list

New service with 2 new methods.

get_capabilities: returns voice-related capabilities for a Text-to-Speech provider - list of synthesis models with supported languages and an example of the per-voice settings payload.

get_voice_list: returns the list of available Text-to-Speech voices for a provider, optionally filtered by language and model.

CallControl

say

Synthesizes text and plays it as a prompt during an active IVR call using a Text-to-Speech provider. Supports codec selection (u_law, a_law, wav, mp3), provider-specific voice settings, and the same playback controls as the play method (repeat, interrupt on input, callbacks). In standalone mode, only previously cached audio is available.

NOTE: API methods for CallControl service are not reflected in API docs (that's by design)

DialingRule

add_dialing_rule
update_dialing_rule

Translation rule safety validation (tr_rule_from_local, tr_rule_to_local) now applies to all rule types (pbx, plan, advanced).

Previously it only applied to advanced. Rules containing unsafe code will be rejected with errEvalTranslationRule.

UA

get_ua_profile_info

The used field in ua_profile_info is now returned as the documented 'Y'/'N' string. Previously it was returned as the integer 0/1, contrary to the schema. get_ua_profile_list already returned 'Y'/'N'.

Clients that consume ua_profile_info.used must accept 'Y'/'N' instead of 0/1.

Product

add_product
update_product

It's not allowed to use fraud_protection='Debit' for input (the value is obsolete now) - the error is raised if you provide it in add/update API request.
But all existing products with 'Debit' are returned as is and you still can change fraud_protection mode for them.

DiscountPlan

add_vd_threshold
update_vd_threshold

For a Service Wallet (top-up) bundle item, notify_threshold_type now accepts only remaining_amount; other values (and a non-negative warning_threshold) are rejected with a fault instead of silently saving a zero threshold.

Product

add_product
update_product

Enabling a service feature whose service is not included in the product is now rejected with a fault (e.g. "emergency" on a product without the Voice Calls service). Disabling, clearing, or inheriting such a feature is still allowed.

Stop enabling service features for services the product does not include.

Account

add_account
update_account

Enabling a service feature whose service is not covered by the account's product or add-ons is now rejected with a fault. Disabling, clearing, or inheriting such a feature is still allowed.

Stop enabling service features for services not included by the account's product or add-ons.

Invoice

review_invoice
review_invoice_list

Added a new value pdf_regenerate to the action field. It regenerates the invoice PDF from the current template for an invoice under review (e.g. after the invoice template was changed), without recalculating charges or payments — the invoice stays under review. The existing approve and regenerate actions are unchanged.

BundlePromotion

delete_bundle_promotion

delete_bundle_promotion is now allowed for the reseller realm — a reseller/sub-reseller can delete a bundle promotion they own (previously admin-only). Deletion is still rejected when the promotion is in use.

XDRMediator

get_xdr_list

Output: gains a new "disconnect_time" field — the date and time when the billing session was disconnected, analogous to "connect_time". It is taken from the stored disconnect timestamp or derived from connect time plus session length, and is empty for records with no voice-style session (e.g. non-voice or error records).

Generic

get_session_data

Output: gains a new operating_mode field reporting the operating mode of the PortaSwitch site that served the request, so an integration can poll it out-of-band and detect when it is safe to route API traffic back to the main site. Possible values:

• normal — the main site, operating in the normal mode;
• secondary — a secondary site in the normal mode (a replica of the main site);
• standalone — a secondary site running in the standalone (delta) mode while the main site is unavailable;
• read_only — the main site, operating in the read-only mode.

Account

get_emergency_details

Added an optional with_inheritance flag ('Y'/'N', default 'N'). When 'Y', the endpoint inherited via the address cascade (account → customer site → customer) is returned instead of only the account's own endpoint.
The response gains a new level field indicating the tier of the returned endpoint ('Accounts', 'CustomerSites', 'Customers').

IPTV

get_channel_package_list
get_service_package_list
get_provider_list

The IPTV methods get_channel_package_list, get_service_package_list and get_provider_list are now available on the reseller, distributor and representative realms (previously admin-only), so those realms can read the IPTV channel/service package and provider catalog. The admin-realm contract is unchanged.

Account

add_followme_number
add_followme_number_list
update_followme_number_list

"redirect_number", "name" and "domain" are no longer mandatory when a follow-me number is created, matching the update path which already allowed them to be empty. A follow-me number can now exist with call forwarding enabled and no destination configured. The format of a supplied "domain" is still validated, and a non-UDP transport without a domain falls back to UDP.

Account

get_account_followme

"redirect_number", "name" and "domain" are now nillable in the FollowMeNumberInfo structure - when empty they are returned as null instead of being omitted from the response, matching "period", "period_description" and "max_sim_calls".

Account

update_followme_number_list

Pushing more than one brand new entry (without "i_follow_me_number") in a single request is now rejected for the Simple forwarding and Forward to SIP URI modes, which allow only one follow-me number per account. Previously this limit was not enforced for new entries added through this method.

Add follow-me numbers one per request for these forward modes.

Template

clone_template

A reseller can now clone a rate upload template under a name that is already used by an administrator - the new name is checked only within the owner's own namespace instead of across the whole environment, and the clone is stored under the reseller's own ownership. Templates of other types keep the administrator namespace and are unchanged.

Template

update_template

Renaming a template to a name already taken within the same owner namespace is now refused with the "update_template.not_unique_name" fault instead of failing on a database constraint. Changing only the letter case of the current name is allowed.

AccessControl

generate_mfa_config
confirm_mfa_config

A user who must enroll in two-factor authentication before signing in can now complete the mandatory enrollment while holding only the Read permission on their own two-factor authentication (Auth_Parameters.mfa). Previously these methods required the Modify permission, which also let the user disable two-factor authentication for themselves. The permission check is waived only while the mandatory enrollment is still pending (two-factor authentication enabled but not yet configured); disabling it via set_mfa still requires Modify.

Notification

add_notification_preset

A notification preset of the "user" type can no longer be created with an owner ("i_customer") - such a preset could never be assigned to anyone, because only a preset without an owner can belong to an administrator. A reseller session is offered the "customer_class" type only; an administrator can still create a "user" preset without an owner.

Create user-type notification presets without an owner; use the customer class type for presets managed by a reseller.

User

get_user_info
get_user_list
add_user
update_user
delete_user
get_notification_list
get_notification_category_list
update_notification_list
get_rt_ticket_list

Administrators whose login is listed in the "Superusers" configuration option are now protected from API users that are not superusers. "get_user_info" and "get_user_list" return such a record reduced to "i_user", "login", "description", "email", "status", "class", "i_acl", "i_role", "role_name", "hide_personal_info" and "is_super_user" - the remaining fields, including "api_token", are withheld. "update_user", "delete_user", "get_notification_list", "get_notification_category_list", "update_notification_list" and "get_rt_ticket_list" return the "Access to the superuser is enabled only for superusers" fault. "add_user" and "update_user" additionally refuse a login listed in that option with the "Only a superuser can assign a login from the Superusers list" fault.

An integration that has to read or manage superuser records must authenticate as a superuser.

WebLog

get_web_log_list

The web log records about an administrator whose login is listed in the "Superusers" configuration option are no longer returned to API users that are not superusers, for any filter and for a request with no filter. What a superuser did to other entities stays visible to every administrator of the environment.