All notable changes to the Sinch Java SDK are documented in this file.
Tag legend
[feature]— new capability[fix]— bug fix[deprecation notice]— will be removed in a future release[dependency]— third-party library update[doc]— documentation only[test]— test coverage[refactor]— internal restructuring[releasing]— release infrastructure[design]— API design change[tech]— technical improvement
- [feature] Default Apache HttpClient retry policy disabled in favor of a dedicated SDK implementation:
- honor the
Retry-Afterresponse header onHTTP 429and fallback to exponential backoff if not present - max retry changed from default Apache HttpClient (
1) to SDK implementation:3
- honor the
- [feature]
HTTP 429retries extended to all endpoints (previously OAuth only), handled by a dedicatedRetryManager - [feature] Retry policy configurable from
SinchClientviasetRetryConfiguration:retryPolicy(DEFAULT,RETRY_AFTER,BACKOFF,NONE),maxRetryCount(default3),exponentialBackoff(default4) - [fix]
HttpClientApache: preserve the status code of anApiExceptionraised during authentication instead of discarding it
- [feature] [Events] Support
ReadMessageEventapp event (WhatsApp only): useReadMessageEvent.READ_MESSAGE_EVENT - [feature] [Messages] [Choice] Support new
displayModefield andDisplayModeenum - [tech] [Templates V2] Synch with backend not returning body onto
delete. No effect at SDK interface level
- Extend
NumberSinchEventclass.- [feature] Support new
NumberSinchEvent:ActiveNumberSinchEventandNumberOrderSinchEvent - [deprecation notice]
NumberSinchEventis now a base class for new use cases from backend:ActiveNumberSinchEventandNumberOrderSinchEvent.- The following fields are deprecated at
NumberSinchEventlevel and will be removed in next major version:getResourceId()getEventType()getStatus()getFailureCode()getInternalFailureCode()
- Use their dedicated
ActiveNumberSinchEventandNumberOrderSinchEventfields
- The following fields are deprecated at
- [feature] Support new
- [feature] Support
dicefield forcustomCallout: the callback URL receiving the DiCE event when the call is disconnected
- [tech] Build
examplesacross a Java version matrix (21,25) in GitHub Actions, replacing the single Java 21 build. - [dependency] Bump
httpclient5.versionto5.6.3to solve a connection leak leading to connection pool exhaustion inhttpclient5(CVE-2026-64607 and GHSA-hjcp-jmpx-g3qm).
- [test] Fix HttpClient multipart test when returned boundary string contains '--' sequence
- [dependency] Bump
jackson.versionto2.21.5to solve@JsonViewbypass vulnerabilities injackson-databind(CVE-2026-59889 and GHSA-mhm7-754m-9p8w). - [dependency] Bump
httpclient5.versionto5.6.2to solve a denial-of-service vulnerability in the transitivehttpcore5dependency (CVE-2026-54399).
- [tech] Build across a Java version matrix (
8,11,17,21,25) in GitHub Actions, replacing the single Java 21 build — unit tests run on11,17,21, and25, and artifacts are built on Java 8. - [tech] e2e tests across a Java version matrix (
8,11,17,21,25) in GitHub Actions, replacing the single Java 21 validation. - [tech] Apply Spotless / Google Java Format per JDK via version-activated Maven profiles (
spotless-jdk8,spotless-jdk11,spotless-jdk17,spotless-jdk21-plus), keeping formatting working across the whole matrix. - [tech] Enable
-Dnet.bytebuddy.experimental=truefor Surefire so Mockito/ByteBuddy run on Java 25. - [dependency] Bump
maven-compiler-pluginto3.13.0, Surefire and Failsafe to3.5.6, and Mockito to5.23.0. - [dependency] Remove unused dependency on
org.apache.maven:maven-model. - [dependency] Bump
jackson.versionto2.21.4to solve a vulnerability injackson-databind(CVE-2026-54513).
- [doc] README: document the supported Java versions (
8,11,17,21,25) with per-version badges and download links, replacing the generic "Java 8+" badge.
- [test] Remove
DateUtilTestcases for unsupported timezone abbreviations (MST,EST): as of Java 25 the JDK no longer resolves legacy COMPAT timezone names (JDK-8325568).
- Extend
NumberSinchEventsclass.- [fix]
EventTypeEnum:DEPROVISIONING_TO_VOICE_PLATFORMis deprecated and has to be replaced byDEPROVISIONING_FROM_VOICE_PLATFORM. - [feature] Support new
internalFailureCodefield. - [feature] Support new
StatusEnumvalues:IN_REVIEW,BLOCKED,COMPLETED,REJECTED,EXPIRED. - [feature] Support new
EventTypeEnumvalue:NUMBER_ORDER_PROCESSING.
- [fix]
- [feature] Support
ConsentsAPI:listIdentitiesandlistAuditRecordsendpoints
- [feature] Support
Number LookupAPI V2
- [feature] HTTP proxy support: configure an unauthenticated or authenticated (Basic) proxy via
HttpProxyConfiguration - [feature]
SinchClientexposes aclose()method to shut down the underlying HTTP connection pool and release all associated resources deterministically - [fix]
HttpClientApache: declare nowheadersToBeAddedasvolatileto guarantee visibility across threads in concurrent usage - [fix]
HttpClientApache: wrap response-bodyScannerin a try-with-resources block to prevent resource leaks; gracefully handle empty (null) response entities - [fix]
SinchClient: guard against aNullPointerExceptionwhenjava.vendorsystem property is absent while building theUser-Agentauxiliary flag - [fix]
Configuration: correct copy-paste error intoString()and Javadoc —conversationContextlabel was incorrectly attributed to the Voice domain - [doc] Improve README structure and content.
- [doc] Fix typos in
conversation/conversations/Createandvoice/applications/GetEventDestinationssnippets
- see MIGRATION-GUIDE
- [dependency] Updated
maven-modeldependency to3.9.14or more recent version to fix security vulnerabilities #8
- [feature] Support
Project SettingsAPI - [feature] Support
Contacts Identity ConflictsAPI - [feature] [Messages] Support new
directionquery parameter forMessagesListQueryParameters - [feature] [Messages] Support
listLastMessagesByChannelIdentityAPI - [feature] [KakaoTalk] Support
COMMERCEandCAROUSEL_COMMERCEchannel specific message - [feature] [LINE] Support
NOTIFICATION_MESSAGE_TEMPLATEchannel specific message - [deprecation notice] [OrderDetailsSettings]
PaymentSettingsdeprecated in favor ofPaymentButtons
- [feature] Support
VerificationSmsDeliveredEventwebhook events - FlashCall
- [feature]
VerificationStartRequestFlashCallsupportinterceptionTimeoutand additionalProperties - [feature]
VerificationStartResponseFlashCallsupport additionalProperties - [feature]
VerificationRequestEventResponseFlashCallsupportinterceptionTimeoutand additionalProperties
- [feature]
- PhoneCall
- [feature]
VerificationStartRequestPhoneCallsupport additionalProperties - [feature]
VerificationRequestEventResponsePhoneCallsupport additionalProperties
- [feature]
- SMS
- [feature]
VerificationStartResponseSmssupportcodeTypeand additionalProperties - [feature]
VerificationRequestEventResponseSmssupportcodeType,expiryand additionalProperties
- [feature]
- WhatsApp
- [feature] [BETA] Support
WhatsAppverification method
- [feature] [BETA] Support
- [feature] Support new DICE reason values
- [fix] Issue #273: Fix NPE when handling 401 response without a token expired header
- [dependency] Bump Jackson dependency to '2.19.0'
- [dependency] Bump generated sources based onto generator '7.13'
- [dependency] Bump maven-gpg-plugin used to sign released artifacts to '1.6'
- [releasing] Migration to replace deprecated OSSRH in favor of SonaType Central
- [test] Activate parallel mode for unit tests
- [fix] Specifications fixed:
TemplateMessage.OmniTemplatefield is now requiring aTemplateReferencewithversionfield filled.TemplateMessage.ChannelTemplatestill use aTemplateReferencewithversionfield not required. To avoid breaking changes and namespace pollution, SDK is accepting a commonTemplateReferenceinstance and validation about the requiredversionfield won't be performed at client level by client, but will validate at backend level after having sent the request.
- [feature]
Reason.channel_codefield added (only for supported by WhatsApp) - [deprecation notice] Emit a warning log onto using default region for Conversation (US). To avoid regulation issue, defaulting to US will no longer be supported in future version and defining the region will be required.
- [test] Clean Jackson cache during unit tests
- [feature]
copyVersionAPI based now returnversionfield in place of deprecatedtemplateone - [doc] Improve Javadoc rendering by separating summary and notes
- [deprecation notice] Emit a warning log onto using default region for Mailgun (US). To avoid regulation issue, defaulting to US will no longer be supported in future version and defining the region will be required.
- [feature] Support Emergency Address
- [feature] Add new API
rent(phoneNumber)without configuration - [feature] Switch from 'Basic' to 'OAuth' auth
- [deprecation notice]
- [refactor] Voice configuration RTC is optional onto requests. No effect at SDK interface level
- [refactor] Move to facade pattern and consume APIs from generator
- [doc] Improve Javadoc rendering by separating summary and notes
- [deprecation notice] Emit a warning log onto using default region for SMS (US). To avoid regulation issue, defaulting to US will no longer be supported in future version and defining the region will be required.
- [test] Extend end-to-end tests against
notify - [feature] Support SVAML
connectStreamaction - [feature] Support
asynchfield foramdRequest - [feature] Define two new values for
AnsweringMachineDetection.Reasonenum
- [feature] Lazy HTTP client initialization until really required
- [feature] Relax domains init for Webhooks when credentials are not required
- [feature] Validation against missing required property at protocol level
- [fix]
CardMessage.media_messageis now ofMediaMessagetype - [feature] New
ListMessage.mediafield is supported - [feature] New SG (Singapore) country defined for WhatsApp order payment details
- [feature] New
ConversationChannelCredentials.credential_ordinal_numberfield is supported - [feature] New
LineEnterpriseCredentialsis supported - [feature] New
LineCredentialsField.isDefaultfield is supported - [feature] New
SendMessageRequest.message_content_typeis supported (enum ofMessageContentType) - [feature] New
ChannelSpecificMessageclasses for WhatsApp:OrderDetailsOrderStatus
- [deprecation notice]
CardMessageMediaclass is deprecated in favor of sharedMediaMessage
- [feature] Support "Emails"
- [feature] Support "Templates"
- [fix]
contentTypeVScontent_typeJSON field name forMediaMessageBodyDetailsat protocol level - [fix] Body requests defined as required at protocol level
- [fix]
UpdateBinaryRequest.udhfield is required at protocol level - [feature]
DryRunPerRecipientDetails.encodingEnumdefined as an enum - [feature] List batches query parameters is accepting a list from values of code
- [deprecation notice] List batches query parameters accepting a single from value (replaced by function above)
- [deprecation notice]
DryRunPerRecipientDetails.encodingis deprecated in favor ofDryRunPerRecipientDetails.encodingEnum
- [feature] Define
AnsweringMachineDetectionused byAnsweredCallEventandNotificationEvent - [feature]
conferenceIdfield is supported byAnsweredCallEventDisconnectCallEventIncomingCallEventNotificationEventPromptInputEvent
- [feature]
NotificationEventsupportdestinationandamdfields - [deprecation notice]
AnsweredCallEventAnsweringMachineDetectionis replaced byAnsweringMachineDetection - [deprecation notice] Following backend endpoint deprecation
applications.queryNumberis deprecated
- [fix]
CardMessageCardMessage.mediafield is ofMediaMessagetype (see Javadoc)CardMessageMediaclass is deprecated (see Javadoc)
- [dependency] Updated Jackson dependency to jackson-jakarta-rs-providers v2.18.2
- [feature] Versioned access to SMS services
- [deprecation notice] Un-versioned access to SMS services (see SMS migration guide)
- [fix] Channel specific message (Messenger / FLOWS) fix for serialization/de-serialization
- [fix] List
ChoiceItem.mediafield fix for serialization/de-serialization
- [deprecation notice] Un-versioned access to Numbers services (see Numbers migration guide)
- [deprecation notice] Un-versioned access to Verification services (see Verification migration guide)
- [deprecation notice] Un-versioned access to Voice services (see Voice migration guide)
- [feature] Support V1 design
- [feature] Follow specification update for SVAML
PlayFiles.locale, field is no longer required - [fix] Webhooks callbacks validation use case-insensitive headers (
validateAuthenticationHeader) - [test] Extend tests coverage (introduced end-to-end tests)
- [feature] Specification update for
VoiceConfiguration.scheduledProvisioningdefined as readOnly - [feature] Specification update for
SmSConfiguration.scheduledProvisioningdefined as readOnly
- [fix] Enable list of parameters grouped by duplicated keys
- [fix] Generated sources with OptionalValue getter: guard against uninitialized value
- [feature] Contains serializer/deserializer to be used for delegation pattern
- [feature] Enhanced javadoc content
- [feature] Store SDK related information within sources
- [feature] Support Conversation API
- [feature] Helper function for webhook authentication header
- [feature]
readOnlyfields are no longer sent over network
- [feature] Align with updated specs for DryRun
- [fix] Enforce webhooks validation logic for empty or missing
authorizationheader
- [fix] Enable list of parameters grouped by duplicated keys
- [feature] Support additional properties onto Start verification by SMS
- [fix] UTF-8 encoding for body payloads.
- [fix] Add missing
WebHooksService.validateAuthenticationHeaderfunction for Numbers
Starting with version 1.2, Numbers domain now support versioned access by using the v1() API calls.
The existing non-versioned services will no longer be updated with new features/fields.
- [design] New versioned service simplified access to available or active: APIs are accessible directly under
v1() - [feature] FAX & EST number's configuration. The
VoiceConfigurationandScheduledVoiceProvisioningmodels have been updated to reflect the "Unified Numbers" API updates: they now hold values for Fax and Elastic SIP Trunking configuration (respectively with the propertiesserviceIdandtrunkId).
- [doc] Error message related to invalid configuration (credentials) fixed
With version 1.1 we are moving to support versioned domain access.
Starting with the Verification domain, you can access services by using the v1() API calls.
The existing non-versioned services will no longer be updated with new features/fields.
-
[feature] [Design] Non-versioned
Verificationdomain is split into dedicated Start and Report new versioned services -
[feature] Synchronization with documentation terms
Calloutrelated fields and APIs are now named Phone CallSeamlessrelated fields and APIs are now named Data
-
[feature] Start Verification
VerificationStartRequestSms- Support
Accept-Languageoption - Support
code typeoption - Support
expiryoption
- Support
VerificationStartRequestPhoneCall- Support
speechoption
- Support
VerificationStartResponseData- [fix]
targetUrifield added
- [fix]
-
[feature] Verification Report
- [fix]
VerificationReportResponse: Report service no longer returns a common status response shared with status service, but a dedicated verification report response.
- [fix]
-
[feature] Webhooks
- [deprecation notice]
VerificationRequestEvent.acceptLanguagefield is deprecated
- [deprecation notice]
-
[tech] Logs
- Reduce logging severity related to phone number not compliant with E164 format
- [feature] Support Numbers API (SDK doc)
- [feature] Support SMS API (SDK doc). Support both unified credentials (projectId) and service planId
- [feature] Support Verification API (SDK doc)
- [feature] Support Voice API (REST API)
- [doc] Online javadoc