RingCentral package v1.0.0

A RingCentral OAuth access token, externally produced and renewed, held in the client's own secret manager. This reference defines ONE stored value and nothing else: the complete Authorization header value (scheme included), 'Bearer ' followed by the access token. The JWT assertion generated in the RingCentral Developer Console for the service extension, and the app's client ID and client secret, are NOT stored under this reference — they belong under separate credential references that only the deployment's custody job may resolve.

RingCentral documents an RFC 7523 OAuth flow: the custody job POSTs to /restapi/oauth/token with grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer, the JWT as the assertion, and a Basic Authorization header from the client credentials, receiving a bearer access token (documented example expiry about two hours) plus a refresh token (documented example expiry about seven days); it stores the resulting 'Bearer <token>' value under this reference and refreshes or re-exchanges before expiry.

The HTTP injector injects the stored value verbatim and performs no OAuth itself — there is no execution-time derivation option. Revocation, according to the reviewed documentation: JWT credentials do not expire unless configured to and can be revoked in the Developer Console by the owner or an administrator, but revoking the JWT stops only new token issuance — already-issued access tokens remain valid until they expire.

RingCentral additionally documents an OAuth revocation mechanism (POST /restapi/oauth/revoke, authenticated with the client credentials, naming the token) that terminates the entire authorization session, invalidating ALL active access and refresh tokens for that session; on suspected exposure the custody job should call it rather than rely on JWT revocation or expiry alone.

Least privilege: generate the JWT for a dedicated service extension, scope the app to the minimum these capabilities need (read extensions, read messages, read call log, SMS only if the send capability is enabled), and prefer account-level read scopes off unless account-wide visibility is reviewed.

Executor hygiene: the executor resolves only this reference, so the only RingCentral material it holds is the stored 'Bearer <token>' value. That value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps. The JWT and the client secret never reach the executor; the custody job that holds them is subject to the same no-logging and no-crash-dump bar. A deployment that cannot meet that bar must not enable the pack.

The endpoint host 'ringcentral-platform.invalid' is a reserved non-production placeholder (an RFC 2606 reserved TLD): substitute the RingCentral platform host (platform.ringcentral.com for production) before enabling, in every endpoint, in the resource locator and in every egress allowlist entry. The allowlist matches exactly, so endpoints and allowlist must be substituted together, and substitution is a required deployment step — the reserved host being allowlisted does not make an unsubstituted pack safe to enable.

This pack registers only operations the retrieved RingCentral documentation establishes: listing account extensions, reading an extension's message store, reading an extension's call log, sending SMS, and deleting a message from the message store.

ACCOUNT_ID, EXTENSION_ID and MESSAGE_ID in the endpoint paths are placeholders the deployment binds before enabling; the API also accepts the '~' shorthand for the account and extension of the authenticated user. RingCentral enforces the app's scopes and the authenticated extension's permissions on every call: SMS can be sent only from numbers owned by the authenticated extension (or company numbers whose SMS assignment points at that extension), and even a super admin cannot send SMS on behalf of other user extensions; the registration records the endpoint, not RingCentral's authorization decision.

The interactive API reference at developers.ringcentral.com was not machine-readable from the review environment (it refused non-browser clients), so the review was made against RingCentral's official documentation repository on GitHub, which the reference pages are built from — a documented source substitution, named in the review block.

Documented exclusions — this pack does not register: fax sending (POST .../fax — the same send-class risk as SMS, deliberately left out); company pager messaging; ring-out and the active call-control APIs (initiating, transferring, recording or dropping live calls is a real-time voice surface requiring its own review); call recording content and metadata access; presence and call-forwarding/answering-rule changes; phone number provisioning and emergency addresses; webhook subscriptions and event notifications; and account or extension administration (creating, modifying or deleting extensions).