Änderungsprotokoll

• BehobenPrice alerts were evaluated against the pool price instead of the retail price, so a threshold set just under the listed price never fired.
• BehobenThe Singapore entry point returned X-VSN-Region: eu-central on catalogue responses served from cache.

• BehobenRentals renewed inside the last hour of their term were charged the new term twice. 41 accounts were credited back automatically the same day.
• BehobenGET /v1/activations dropped the status filter once the cursor was followed past page 20, so later pages mixed completed and cancelled orders.
• GeändertThe compatibility endpoint rejects action=getNumber with an unknown service code in about 12 ms instead of waiting on a pool lookup that could never succeed.

Bulk activations

Buy up to 50 numbers for the same service and country in one call, with a result per item instead of an all-or-nothing failure.

• NeuPOST /v1/activations/bulk accepts up to 50 items and returns one result object per requested number, each with its own status and error code.
• NeuBulk purchase in the dashboard, with a live progress panel and per-row cancel while the batch is still filling.
• GeändertIdempotency keys apply to the whole bulk request: a replay returns the original result set rather than buying a second batch.
• GeändertBulk requests draw from at most three operators per batch, so a single bad range cannot take out an entire order.
• BehobenThe pool scorer counted a failed batch once per request rather than once per number, which under-penalised operators that failed in bulk.

• EntferntPOST /v1/activations no longer accepts a pinned operator field, as announced on 2025-09-23. Requests that still send it are accepted and the field is ignored.
• BehobenTwo-factor enrolment rejected authenticator apps that pad the shared secret to 32 characters with base32 padding.
• BehobenCountry pages listed services whose only operator in that country had been retired six weeks earlier, so the row always showed zero stock.

Per-country retention

• NeuMessage retention is configurable per country between 1 and 30 days on contract accounts, for teams with data-residency commitments of their own.
• NeuretentionDays on the activation object, so a script can see what applies to a number before it buys it.
• GeändertThe nightly retention job writes an audit record per deleted batch — count, country and cut-off — available to business accounts on request.
• BehobenDeleting an activation's messages from the dashboard left the extracted code in the CSV export until the next nightly run.

• BehobenGET /v1/prices with more than 20 service and country pairs hit the gateway timeout instead of returning 400 with a clear limit error.
• BehobenThe Frankfurt entry point served stock counts up to 90 seconds stale after a pool refresh, while Singapore served them immediately.

• BehobenWebhook endpoints disabled after 72 hours of consecutive failures were silently re-enabled by any edit to their event list, including removing an event.
• Behobenwebhook.test deliveries counted towards the failure streak that disables an endpoint, so testing a broken endpoint could disable it.

Webhook tooling

• NeuSend a synthetic event of any type to a registered endpoint from the dashboard, signed exactly like a real delivery.
• Neuwebhook.test event type, excluded from delivery statistics and from the retry schedule.
• NeuThe delivery log keeps the request body, the response status and the first 2 KB of the response body for seven days, with a manual replay per delivery.
• GeändertAn endpoint that fails continuously for 72 hours is disabled, after warning emails at 6 and 24 hours.

• BehobenPrice alerts were evaluated hourly rather than on every pool refresh, so dips that lasted under an hour went unreported.
• BehobenThe uptime strip on the status page rendered left to right under Arabic while the rest of the page mirrored, putting today on the wrong end.

Price alerts

• NeuPrice alerts for a service and country pair, delivered by email or webhook when the retail price crosses a threshold you set.
• NeuGET /v1/prices accepts up to 50 service and country pairs in one request instead of one pair per call.
• Neu23 countries, mostly Central American and Pacific territories. Coverage crosses 190 countries and territories.
• VeraltetPinning operator on POST /v1/activations. Routing already picks the healthiest operator with stock; the field is ignored from 2026-03-31.

Twelve-month rentals

• NeuRental terms of 6 and 12 months, at a price fixed for the whole term rather than repriced at each renewal.
• Neurental.expiring webhook event, fired 24 hours before a rental ends.
• GeändertAuto-renew checks that the upstream lease can actually be extended before it debits the balance, instead of debiting first and refunding on failure.
• BehobenRentals crossing a daylight-saving boundary expired 60 minutes early in Europe/London and Europe/Lisbon.

• BehobenIdempotency keys were stored per region, so a retry that landed in Singapore after a Frankfurt timeout bought a second number. Duplicate purchases in the affected window were refunded.
• BehobenX-VSN-Region was missing from 402 and 429 responses.

Multi-region API

A second API entry point in Singapore cuts median round-trip latency from South-East Asia from 310 ms to 74 ms.

• NeuRegional entry points in Frankfurt and Singapore, selected by anycast. Both read the same catalogue and the same balance.
• NeuX-VSN-Region on every response, naming the entry point that served it.
• GeändertA long-poll connection is pinned to the region that accepted it for the life of the wait, so a code is never delivered to a region the client has left.
• GeändertPurchases are still serialised through the primary in Frankfurt; only reads and long-polls are served locally. Balance can never go negative because of a regional split.

• BehobenLogin alerts fired after every browser update, because the full user agent string was part of the device fingerprint.
• BehobenSessions expired 30 days after creation rather than after 30 days of inactivity, which is what the documentation and the setting both said.

Account security

• NeuTwo-factor confirmation is required to create an API key or widen its scopes, on accounts that have 2FA enabled.
• NeuEmail alert on sign-in from a new device or a new country, with the IP and the approximate location.
• GeändertSessions expire after 30 days of inactivity instead of 30 days from creation.
• GeändertRecovery codes are invalidated as a set when two-factor authentication is re-enrolled, so an old printout stops working.

• Neu19 countries across East and West Africa — Ethiopia, Tanzania, Uganda, Zambia, Senegal, Ivory Coast and others.
• NeuSupport tickets opened from the dashboard carry the last 20 activations as context, so the first reply is not a request for identifiers.
• GeändertThe operator field on a completed activation names the range holder rather than the reseller we bought through, which is what you need to correlate failures.
• BehobenService pages returned an empty table rather than an empty state when a country had no stock at all, which read like a loading failure.

• BehobenThe MCP server advertised rentals:write tools to keys that did not hold the scope; calls failed with 403 rather than being hidden.
• BehobenrequestId was missing from responses produced by the rate limiter, which are exactly the ones support gets asked about.
• BehobenThe OpenAPI document declared wait as an integer while the API also accepted a numeric string.

Agent-ready API

A hosted MCP server, an OpenAPI 3.1 document and an llms.txt index, so an agent can discover and drive the whole activation lifecycle with a scoped key.

• NeuA hosted MCP server exposing buy, poll, cancel, complete and balance as tools, bound to the scopes of the key that connects.
• Neullms.txt at the site root, indexing the public surface — pricing, endpoints, limits and policies — for agents and crawlers.
• Geändert/openapi.json is now OpenAPI 3.1, generated from the same schema the API validates requests against, so the document cannot drift.
• GeändertEvery response carries requestId. Quoting it in a ticket is enough for support to find the exact request.
• GeändertBearer tokens are the documented default. X-Api-Key keeps working, is not deprecated, and will not be removed.

• BehobenTwo services shared a slug after a rename, so one of the two service pages returned 404 for eleven days before anyone told us.
• BehobenHreflang alternates on service pages pointed at the English URL for every language.

• Neu46 services, mostly regional marketplaces and wallets in South-East Asia and Latin America, including Shopee, Lazada, Mercado Libre and PicPay.
• EntferntGET /v1/history, deprecated on 2024-06-11. Use GET /v1/activations, which is a superset.
• GeändertThe compatibility endpoint returns NO_NUMBERS instead of NO_BALANCE when the pool is empty but the balance is sufficient, which is what the original protocol means.

• NeuLocalised metadata, canonical URLs and hreflang alternates for all fifteen interface languages.
• NeuA sitemap covering every service and country landing page in every language.
• GeändertPublic pages are statically rendered and revalidated every five minutes. Time to first row on the pricing table fell from 1.9 s to 0.4 s.
• BehobenThe 15-minute post-release hold was applied per provider rather than per number, which shrank the effective pool in countries with fewer than 200 numbers.

• NeuA fifth upstream provider, adding US and Canadian coverage for 60 services that previously had none in North America.
• NeuX-RateLimit-Reset as a Unix timestamp, alongside the existing limit and remaining headers.
• GeändertA released number is held out of the pool for 15 minutes, so a re-issue after a rejected verification does not land on the same range.

• BehobenActivation windows shorter than 10 minutes were still refunded on the 20-minute schedule, delaying the credit by up to ten minutes.
• BehobenAnomaly alerts compared the current success rate against an all-time average instead of the trailing seven days, so seasonal services alerted constantly.

• NeuAnomaly alerts: an email when a service and country pair you have used in the last 30 days drops more than 20 points in success rate.
• NeuThe activation window is configurable per purchase between 5 and 30 minutes. The default stays 20.
• GeändertCursor pagination on GET /v1/activations breaks ties on the identifier rather than the timestamp alone, so two activations created in the same millisecond are both returned.

• NeuGET /v1/activations with cursor pagination, status filters and a date range.
• NeuCSV export of activation history from the dashboard, with no row cap.
• NeuThe export includes the operator and the full SMS body where retention still allows it, so an audit does not need a second API call.
• VeraltetGET /v1/history, superseded by GET /v1/activations. It stops answering on 2024-11-15.

• BehobenConsolidated monthly invoices double-counted refunds issued in the last hour of the month.
• BehobenPurchase-order references longer than 40 characters were truncated on the PDF without any indication.

Business accounts

• NeuContract rates, dedicated operator pools, a data processing agreement and net-15 terms for accounts above roughly 5,000 SMS a month.
• NeuMonthly consolidated invoices carrying purchase-order references.
• NeuA named escalation contact and a private channel for P1 issues.
• GeändertThe published SLA for contract accounts is 99.9 % monthly API availability with a 15-minute response on P1, measured excluding announced maintenance.

• NeuTON, BNB and SOL as top-up currencies through OxaPay.
• NeuUnder-payment handling: a partial deposit is credited for the amount actually received as soon as it is attributed, instead of being held for manual review.
• GeändertInvoice quotes are locked for 30 minutes instead of 15, after measuring how long Bitcoin confirmations really take at median fee rates.
• BehobenA deposit sent to an expired invoice address needed a support ticket to be credited. Attributable deposits are now credited automatically within an hour.

• BehobenPayout requests between €50.00 and €50.99 were rejected by an off-by-one comparison in cents.
• BehobenThe referral dashboard showed lifetime earnings in the tier progress bar instead of the trailing-12-month figure the tier is based on.

Referral tiers

• NeuVolume tiers on the referral program: 7 % above €500 of referred spend, 10 % above €5,000.
• NeuReferral payouts in crypto once earnings exceed €50, to the address you nominate.
• GeändertCommission is calculated on what a referral spends, not on what they top up, so a large deposit no longer pays out before it is used.
• GeändertEarnings land on the balance as they are earned instead of being settled overnight.

• Neu34 services in delivery and ride-hailing, including Bolt, Glovo, inDrive, Rappi and Gojek.
• NeuPer-service landing pages with live price, stock and success rate for every country that has numbers for it.
• GeändertThe 24-hour success rate is computed over a rolling window rather than the previous calendar day, so a bad morning shows up before midnight.

• BehobenAll-senders rentals dropped messages from alphanumeric sender IDs shorter than three characters.
• BehobenRental prices were quoted per day by the API and per term in the dashboard, which disagreed by a few cents on three-month rentals.

• NeuRentals in all-senders mode: receive from any sender, not only from the service you picked.
• Neu12 more countries eligible for rental, including Japan, South Korea and Australia.
• GeändertRental prices are quoted per term rather than per day, which is how the upstream actually charges and why short rentals looked oddly expensive.
• BehobenDeleting the messages of an activation left the extracted code visible in the activation list.

• NeuUkrainian interface translation, covering the catalogue and the legal pages.
• NeuPer-activation message deletion from the dashboard, ahead of the 30-day retention cut-off.
• GeändertRetention is enforced by a nightly deletion job with an audit record instead of being filtered on read, so expired bodies are actually gone.

• BehobenReplaying a webhook delivery re-sent the original timestamp, so endpoints enforcing a five-minute signature tolerance rejected every replay.
• BehobenThe uptime strip on the status page rendered 91 bars for visitors in time zones ahead of UTC.

• Neu21 countries across the Middle East and the Gulf, including Iraq, Jordan, Lebanon, Oman and Qatar.
• NeuA webhook delivery log with the request, the response status and a manual replay.
• GeändertWebhook secrets can be rotated with a 24-hour overlap during which both the old and the new signature are accepted.

Status page and changelog

• NeuA public status page with 90-day uptime per component and the full incident history.
• NeuThis changelog, with an RSS feed at /changelog.xml.
• GeändertMaintenance windows are announced on the status page at least 48 hours in advance.

• BehobenX-VSN-Pool was omitted on responses served from the idempotency cache.
• BehobenPool scores were not reset when an operator returned from a maintenance window, so traffic kept avoiding it for hours after it was healthy again.

• BehobenThe new scorer treated an operator with fewer than 20 samples as perfectly healthy and sent early traffic to cold ranges. Operators now start at the pool median.
• BehobenPurchases returned 503 instead of 409 when every scored operator for a combination was exhausted.

Pool rewrite

Operator selection moved from a per-request provider lookup to a continuously scored pool. Median time to issue a number fell from 2.6 s to 0.9 s.

• GeändertScores are recomputed every 30 seconds for each service, country and operator combination, instead of being looked up at purchase time.
• NeuX-VSN-Pool names the pool that served a purchase, so a failure can be traced back to a range.
• NeuPurchases skip any operator whose trailing 24-hour success rate is below 60 %, even when it is the cheapest.
• EntferntGET /v1/prices?flat=1, deprecated on 2022-08-16. The grouped response replaces it.

• BehobenThe / search shortcut hijacked typing inside the promo-code field on the top-up page.
• BehobenA key sitting exactly at its daily spend limit returned 500 instead of 402 with a clear error code.

• Neu30 services in finance and crypto, including Kraken, Bybit, Bitget, Nubank and Wise.
• NeuSearch across services and countries from any page with the / shortcut.
• GeändertThe pricing page loads the grouped catalogue in one request instead of two, which halved time to first row on slow connections.

• NeuPer-key spend limits, daily and monthly, enforced at purchase time rather than reconciled afterwards.
• NeuGET /v1/me, returning the calling key's scopes, limits and remaining budget.
• GeändertScopes split into numbers:read, numbers:write, balance:read and rentals:write. Existing keys were mapped to the equivalent set with no change in behaviour.

• BehobenThe operator name was empty on activations served through the legacy compatibility endpoint.
• BehobenArabic-Indic digits appeared in activation countdowns, where tabular Latin digits are used everywhere else.

• NeuA fourth upstream provider. Pool depth in Nigeria, Kenya and Egypt roughly doubled.
• NeuThe operator name is recorded on every completed activation, so a run of failures can be correlated with a specific range.
• GeändertFailover retries a different operator when the first attempt times out, instead of retrying the same one and burning the window.

• BehobenCall transcripts longer than 480 characters were truncated with no ellipsis and no truncated flag on the object.
• BehobenVoice-to-text delivered the transcript twice when the caller hung up during the beep.

• NeuVoice-to-text on rentals in 11 countries: an inbound call is transcribed and delivered as a message.
• Neucall.received webhook event, carrying the transcript and the caller ID where the operator provides one.
• NeuRental terms of 3 months.
• VeraltetGET /v1/prices?flat=1. The grouped response replaces it and carries the same data; the flat shape stops working on 2023-03-15.

• BehobenThe dashboard sidebar did not mirror under RTL, so the activation timeline ran off the right edge in Arabic.
• BehobenThe Indonesian translation applied the activation status labels to rentals, where the states are different and two of them do not exist.

• NeuHindi, Indonesian and Arabic interface translations, with full right-to-left layout support.
• Neu24 countries, mostly Caribbean and Pacific territories.
• GeändertRate limits burst to 20 requests per second within the per-minute budget, instead of rejecting anything above two per second.
• BehobenThe stable code field was missing from the 402 returned when the balance is too low.

• NeuAn OpenAPI 3.0 document at /openapi.json, generated from the schema the API validates against.
• NeuOfficial Python and Node clients, dependency-free and thin enough to read in one sitting.
• GeändertError responses carry a stable machine-readable code. The human-readable message is explicitly not stable and should never be parsed.

• BehobenActivations for services with an apostrophe in the name failed the legacy getNumber action with BAD_SERVICE.
• BehobenThe theme cookie was not read during the first server render, so accounts on the light theme saw a dark flash on every navigation.

• Neu19 countries in the Balkans and Eastern Europe — Serbia, Bosnia and Herzegovina, Albania, Moldova, Montenegro and North Macedonia among them.
• GeändertSupport moved to 24/7 cover in English, French, Russian and Spanish. Median first response is now under 12 minutes.
• GeändertThe pricing table groups by service by default, with the country view one click away.

• NeuDark and light themes with a per-account preference, stored in a cookie so the first paint is already correct.
• NeuGerman, Italian and French interface translations.
• GeändertThe activation card shows the full SMS body next to the extracted code, not only the code.

• BehobenThe balance-low alert fired on every purchase once the threshold was crossed, instead of once per crossing.
• Behobenbalance.low webhooks were sent before the debit was committed, so the payload showed the pre-purchase balance.

• NeuBalance-low email alert with a per-account threshold.
• Neubalance.low webhook event.
• Neu40 services, including Revolut, Binance, OKX and Coinbase.

• NeuA third upstream provider, adding depth in India, Indonesia and Bangladesh.
• NeuA seven-day stock history on each pricing row, so you can see whether a country is drying up before you plan around it.
• GeändertRouting weighs price against the trailing success rate instead of picking on price alone. Slightly more expensive numbers that actually deliver now win.
• BehobenA pool refresh could briefly report zero stock for every Indian service.

• BehobenIPv6 allowlist entries carrying a zone identifier were rejected as malformed.
• BehobenThe seven-day stock history bucketed by the account time zone but labelled the axis in UTC.

• NeuIP allowlists on API keys, accepting IPv4, IPv6 and CIDR ranges, one per line.
• NeuTurkish, Polish and Vietnamese interface translations.
• GeändertAPI keys are shown once at creation and only a prefix is stored afterwards. Existing keys were rotated and the old values are no longer retrievable by anyone, including us.

• NeuIdempotency keys on POST /v1/activations. A replay within 24 hours returns the original response instead of buying a second number.
• NeuLong-polling on GET /v1/activations/{id} with wait= up to 180 seconds, so tight polling loops are no longer necessary.
• GeändertWebhook retries use exponential back-off across 24 hours over eight attempts, instead of five attempts inside an hour.

• BehobenWebhook signatures were computed over the parsed body, so endpoints that re-serialised the JSON before verifying saw a mismatch.
• BehobenRentals bought in the hour before a daylight-saving change expired 60 minutes early.
• BehobenAuto-renew debited the balance even when the upstream lease could not be extended. The affected charges were credited back the same week.

Number rental

Keep the same number from four hours to one month and receive unlimited SMS from the service you choose.

• NeuRentals with terms of 4 hours, 12 hours, 1 day, 3 days, 1 week and 1 month.
• NeuPOST /v1/rentals and GET /v1/rentals/{id}, with optional auto-renew six hours before expiry.
• NeuRental available in 15 countries in the first wave, including the United Kingdom, France, Germany, Spain, Poland, Canada and the United States.

• NeuWebhooks: sms.received, activation.completed and activation.expired, signed with HMAC-SHA256 over the raw body.
• NeuGET /v1/countries and GET /v1/services catalogue endpoints.
• GeändertDefault rate limit raised from 60 to 120 requests per minute per key.

• BehobenLive activation cards stopped updating after the tab had been in the background for more than five minutes.
• BehobenThe language-prefix redirect dropped the query string, which broke referral links carrying ?ref=.

New dashboard

The dashboard was rebuilt around live activation cards, so a code appears the moment it lands rather than on the next refresh.

• NeuLive activation cards with the countdown, the full SMS body and one-click copy for both the number and the code.
• GeändertThe interface language is part of the URL (/en/, /ru/), so every page is linkable and shareable per language.
• GeändertActivation objects gained smsText, receivedAt and operator. Existing fields are unchanged.
• GeändertPrices and stock refresh every 60 seconds in the browser without a page reload.

• Neu26 countries across Central Asia and the Caucasus, including Kazakhstan, Uzbekistan, Georgia, Armenia and Azerbaijan.
• NeuCSV export of activation history, capped at 5,000 rows per file.
• BehobenKazakh numbers were displayed with the +7 country code split in the wrong place.

• NeuA second upstream provider in the pool, with per-service health scoring and automatic failover.
• NeuCountry-level success-rate badges on the pricing page, computed over the trailing 24 hours.
• GeändertThe first top-up minimum moves from €10 to €30, announced by email on 2020-12-08. Existing balances are unaffected and repeat top-ups stay at €10.
• BehobenSuccess-rate badges rounded 84.6 % up to 85 % and crossed the healthy threshold visually while the real rate had not.

• BehobenReferral attribution was lost when a visitor switched language before signing up.
• BehobenThe activation countdown drifted by up to 40 seconds in tabs left in the background.
• BehobenRecovery codes could be redeemed twice if two requests arrived within the same second.

• NeuReferral program: 5 % of referred spend, credited to balance as it is earned.
• NeuSpanish, Portuguese and Chinese interface translations.
• GeändertDefault rate limit raised from 30 to 60 requests per minute per key.

• NeuTwo-factor authentication with TOTP and ten single-use recovery codes.
• NeuAn active-session list in Settings, with per-device sign-out.
• GeändertSessions are bound to a rotating token, so a stolen cookie stops working at the next rotation.

• BehobenInvoice PDFs rendered Cyrillic company names as empty boxes.
• BehobenThe code extractor missed four-digit codes wrapped in non-breaking spaces, which two Brazilian senders use.

• NeuPDF invoices for every top-up, with optional company details on the document.
• Neu31 services, including Bumble, Signal, Grindr and Airbnb.
• GeändertActivation history keeps the full SMS body for 30 days instead of the extracted code alone.

• NeuMulti-SMS mode: keep an activation open for further messages from the same service, billed at 30 % of the base price per extra message.
• Neu18 African countries, including Nigeria, Kenya, Ghana, South Africa, Egypt and Morocco.
• GeändertRate-limit headers are returned on 429 responses, so back-off logic has something to read.

• BehobensetStatus with status 8 released the number but left the order marked as waiting for about 90 seconds.
• BehobenCancelling an activation twice within the same second credited the refund twice.

handler_api compatibility

• NeuA compatibility endpoint that speaks the classic handler_api protocol, so existing scripts run unchanged with only the api_key swapped.
• NeugetBalance, getNumber, getStatus and setStatus, returning the original ACCESS_ and STATUS_ tokens.
• GeändertAPI keys are stored hashed. Existing keys were rotated and the plaintext is no longer retrievable.

• BehobenGET /v1/prices returned services with zero stock when available=true was passed.
• BehobenLong service names overflowed the activation card on screens narrower than 380 px.

• Neu22 countries across Latin America and South-East Asia, including Brazil, Colombia, Peru, Vietnam and the Philippines.
• NeuEmail notification when a code arrives, opt-in per account.
• GeändertPrices and stock refresh every 60 seconds instead of every five minutes.

• BehobenStock counters for Indonesia showed the provider's whole pool instead of the subset registered as Telegram-capable.
• BehobenPassword reset links expired after 15 minutes rather than the documented 60.

• NeuRussian interface translation, including the catalogue and the support forms.
• NeuGET /v1/prices, returning live price and stock per country for a service.
• NeuA per-service success rate over the trailing 24 hours, shown on every price row.

• NeuNine countries: Poland, Romania, Portugal, Czechia, Hungary, Bulgaria, Croatia, Slovakia and Lithuania.
• NeuDiscord, Tinder, Steam and Yandex.
• NeuUSDT-ERC20 and Litecoin as top-up currencies.
• GeändertThe activation window is 20 minutes, up from 15, after measuring how long real delivery tails actually run.

• BehobenActivations bought between 00:00 and 00:05 UTC were billed against the previous day's price snapshot.
• BehobenAn OxaPay callback for a Bitcoin deposit could be replayed into a duplicate credit when the first callback timed out.
• GeändertBalance is credited on the first network confirmation instead of the third.

Public launch

VirtualSMSNumbers opens to the public with one-time activations in 14 countries and a prepaid balance funded in crypto.

• NeuOne-time SMS activations across 14 countries and 40 services.
• NeuA prepaid balance in euros, funded with BTC and USDT-TRC20 through OxaPay.
• NeuPOST /v1/activations and GET /v1/activations/{id}, authenticated with a bearer key.
• NeuAutomatic refund to balance when no message arrives inside the 15-minute activation window, with no ticket to open.