{
  "id": "CMP-HTTPS",
  "slug": "cmp-https",
  "title": "Every URL must use HTTPS",
  "statement": "All URLs in the registration must use https://; plain http:// is rejected.",
  "rationale": "A plain http:// link exposes the recipient to interception on exactly the channel carriers are trying to make trustworthy, so it is refused. This is the single highest-consequence cheap defect in the catalog: Twilio's current code for it is NOT eligible for resubmission, so one forgotten \"s\" can permanently kill a campaign rather than earning a fixable rejection.",
  "layer": "CAMPAIGN",
  "layerSlug": "campaign",
  "object": "campaign.sample[] + campaign.message_flow + urls",
  "severity": "BLOCKING",
  "detectability": [
    "DETERMINISTIC"
  ],
  "failureClass": "RETRY_FIELD",
  "authorities": [
    "Twilio",
    "Infobip",
    "TCR",
    "Bandwidth"
  ],
  "codes": [
    {
      "provider": "Twilio",
      "code": "30964",
      "remediable": false,
      "generation": "gen2"
    },
    {
      "provider": "Infobip",
      "code": "10900",
      "remediable": true
    }
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Replace every http:// link with its https:// equivalent and confirm the certificate is valid.",
  "example": "https://acmecoffee.com/sale",
  "notes": "Twilio 30964 is NOT eligible for resubmission — a plain http:// link can permanently kill a campaign. Highest severity-to-effort ratio in the whole catalog.",
  "catalogIds": [
    "MSG-097"
  ],
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/campaign/cmp-https/",
  "markdown": "https://ekas.io/rules/10dlc/campaign/cmp-https.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}