TWILIO_ACCOUNT_SID, TWILIO_API_KEY_SID and TWILIO_API_KEY_SECRET) in ConfigView when setup is complete.
What this data is. ConfigView inventories your Twilio estate and what it costs: the main account and its subaccounts with their status, every phone number and the host each of its webhooks points at, API keys (name and age only), Messaging Services, SIP domains and credential list names, and this month’s spend by usage category for each account. It never reads call or message content, recordings, call logs, phone numbers of your customers, SIP usernames or passwords, or any secret. Webhook addresses are reduced to their host (for example hooks.example.com) because the path and query string can carry tokens. ConfigView never creates, changes or deletes anything in Twilio.
What you need
- A Twilio Console login that can create API keys (an account owner or admin)
- Know which API key type you want to use. The choice decides what ConfigView can read:
If you want the full picture (subaccount list and API key ages), use a Main key. If you want the narrowest key, use a Restricted key and accept that those two areas are empty.
Your Twilio Console users are not collected. Twilio’s account-level REST API has no endpoint that lists the people who sign in to the Console or their roles. Twilio does offer a separate SCIM API for organization-managed users, which uses different credentials and is not read by ConfigView today. Review Console users under Admin, Account management in Twilio.
Step 1: Open the Twilio page in ConfigView
Open ConfigView in a second browser tab and leave it open:https://{companyname}.configview.com/admin/integrations/twilio
Twilio shows an API key secret only once, when the key is created, so paste it straight into ConfigView instead of keeping it in a notes file.
Step 2: Copy the Account SID
- Sign in to the Twilio Console
- On the account dashboard, find Account Info and copy the Account SID (it starts
AC) - In the ConfigView tab, paste it into
TWILIO_ACCOUNT_SIDunder Credentials, then click the save icon
Step 3: Create an API key
- In the Twilio Console open Account, then API keys & tokens, then Create API key
- Name it
ConfigViewand pick the key type from the table above - Copy the SID (starts
SK) intoTWILIO_API_KEY_SID, and the Secret intoTWILIO_API_KEY_SECRET. Save each one in ConfigView
Step 4: Connect and verify
- Back on
https://{companyname}.configview.com/admin/integrations/twilio, confirm the three credentials show as saved - Click Connect. ConfigView creates its tables and schedules every collector at your default run time. Stop any you don’t want under Collectors:
- Click Verify now. The health check reads this month’s usage for the main account and tries one record from each of the other areas.
- The API call fails with 401. The key SID or secret is wrong, the key was deleted, or it belongs to a different account than the Account SID. Create a new key and paste all three values again.
- The API call fails with 403. The key cannot read Usage records. Grant it, or use a Standard or Main key.
- An area shows as skipped. Twilio answered “unauthorized”, “forbidden” or “not found” for it. Accounts and API Keys are skipped with any key that is not a Main key. Nothing to fix unless you want that data.
Data Tables
Once the scripts run, these tables are created in your database. Each table has arun_at column and a raw_json column, which holds the record as Twilio returned it, minus anything listed under What isn’t collected. Every table except twilio_usage_this_month keeps only the newest run.
Things worth knowing
Subaccounts. Twilio documents that subaccount resources are reached with the main account’s SID and Auth Token, or with an API key created in the subaccount itself. It also says Main API keys are for main-account resources. ConfigView uses an API key, so for each subaccount it tries the request and, when Twilio refuses, skips that subaccount and says so in the run log. The main account is always collected. Spend for the main account is its own spend only, not its subaccounts’ (ConfigView asks Twilio for each account separately so nothing is counted twice). Spend and roll-ups. Twilio returns parent categories (such ascalls, sms and totalprice) alongside the categories inside them. twilio_usage_this_month.is_rollup is 1 for those parents and is_total is 1 for the account’s totalprice row. Sum only rows where is_rollup = 0 to add up spend by category, or read the is_total = 1 row for an account’s total. Categories with no usage and no cost are not stored.
This month only. Usage is the month to date. Each run adds a new set of rows, so the table grows over the month and across months; filter on the newest run_at for the current figures.
Webhook hosts. Only the host of each webhook is kept. A number whose webhook points at a host you do not recognize, or at a tunnel such as ngrok.io, is worth a look. Numbers attached to a TwiML App, a trunk or a Studio flow can show no host here because Twilio ignores the URL fields in that case.
Rate limits. Twilio does not publish a requests-per-minute limit for these endpoints. It limits concurrent requests and answers 429 when exceeded. ConfigView sends one request at a time at no more than 120 a minute per script and backs off on 429.
What isn’t collected
- Twilio Console users and their roles (see above)
- The Account Auth Token, API key secrets, and any field whose name contains token, secret or password
- SIP usernames and passwords, and the contents of SIP credential lists
- Calls, messages, recordings, transcriptions and their logs, and the phone numbers of people you contacted
- Webhook paths and query strings (only the host is kept)
- Verify, Conversations, Studio, Flex and other products that sit on their own subdomains
- Messaging Services of subaccounts