2026b
This release centers on a major security upgrade: authentication for Compass and Studio now runs through a central identity provider. Alongside this, the REST API has become feature-complete for managing the core objects in the platform. Users, identities, extensions, forwards, external numbers and conferences can now be created, updated and deleted entirely through the API.
Behind the scenes we’ve also continued modernising the platform for long-term reliability and maintainability.
Important changes
Changed
Central authentication
Authentication is now handled by a central identity provider, using the industry-standard OpenID Connect protocol. This is an important step in hardening how you and your users sign in to the platform and how API clients are authorised.
For users this means:
- The separate Studio
/loginpage no longer exists. Logging in now goes through a central login page on theauth.domain. Please update any bookmarks and password-manager entries accordingly. - Your existing username and password keep working. Accounts are migrated automatically and no password reset is required.
- The login page is available in Dutch and English, based on your browser language, and can be branded per reseller on whitelabel domains.
- API access uses standard OAuth2 bearer tokens.
- Logging in to Bridge, Navigator and Panel is not affected by this release.
- Flows for creating, updating and removing users by an admin are unaffected.
- To protect against brute-force attacks, the login and other authentication endpoints are now rate limited per IP address. Repeated rapid requests are slowed down and eventually rejected; normal interactive use is not affected.
Aside from the new login page, signing in is unchanged from a user’s perspective. You’ll be guided to it automatically. This central setup also lays the groundwork for future security capabilities such as single sign-on and multi-factor authentication.
Fixes
- Call recording notification emails now show the correct phone numbers in the
FromandTofields for internal calls, such as calls picked up in a queue. Previously these emails could show internal user names instead. - Fixed an issue where call recordings were missing for some calls, in particular around queue pickups and calls that were placed on hold and resumed.
- Fixed a quoting issue with the SIP
Referred-Byheader in the dialplan, which affected transfers. - Fixed the ordering of trunk re-invite SIP messages.
- Deleting an external number now also removes the call-flow switches it used. Previously these could remain visible in Studio and Navigator after the number was gone.
- Deleting a company’s default external number (DID) via the API now automatically assigns a next-best default instead of clearing it, preserving emergency-dialing behaviour.
- Creating a phone model with too long a shortname now returns a clear validation error instead of a
500in the reseller API.
REST API
Added
The REST API is now feature-complete for the core objects. With PUT, PATCH and DELETE now available, their full lifecycle can be managed programmatically.
Users
PUT /user/{id}: Replace an existing userPOST /user/{id}/createIdentity: Create a new identity for a userGET /user/{id}/groups: List the groups a user is a member of
Identities
PUT /identity/{id}: Replace an existing identityDELETE /identity/{id}: Delete an identity
Extensions
PUT /extension/{id}: Replace an existing extensionPATCH /extension/{id}: Update an existing extension
Forwards
PUT /forward/{id}: Replace an existing forwardPATCH /forward/{id}: Update an existing forward
External numbers
PUT /externalNumber/{id}: Replace an existing external number
Conferences
PUT /conference/{id}: Replace an existing conferencePATCH /conference/{id}: Update an existing conference
Groups
GET /group/{id}: Retrieve the properties of a groupDELETE /group/{id}: Delete a groupGET /group/{id}/reseller: Get the reseller that contains this groupGET /group/{id}/entitiesFiltered: Retrieve base information of the direct child entitiesGET /group/{id}/resourcesFiltered: Retrieve base information of the resources belonging to this group
Voicemail
PATCH /voicemail/{id}/messages/{messageId}: Mark a voicemail message as old or new
XMPP
Added
A new XMPP event is now sent when a new voicemail message is recorded, so clients and integrations can be notified of new voicemail in real time without polling. The event carries the caller ID, the time it was received, the duration, and whether the message is new.
Combined with PATCH /voicemail/{id}/messages/{messageId}, a message can then be marked as read.
We’ve continued to modernise the platform behind the scenes. Several core modules have been migrated from Java to Kotlin, including Lisa and a number of database layers. Object storage access has been refactored, the recording-conversion timeout is now configurable, and Asterisk was updated to 20.20.1.
We also improved observability and reliability across the platform with additional Prometheus exporters and service discovery, rate limiting for the new authentication components, and faster CI pipelines.
Known issues
We are aware of the following issues. Please don’t open new support tickets for them.
- GL-3376: Large XMPP rosters are shortened by the platform
- GL-3847: User call forwards are not followed in accordance with the availability status