Outbound call fails with 403 telephony_provider_permission_denied, but another Twilio number on the same SIP trunk works

I’m trying to import a Twilio number into Retell using SIP trunking for outbound calls.

I already have another Twilio numb connected to Retell through the same general setup, and that number works. But this new number is failing on outbound calls.

The failed Retell call log says:

SIP status code: 403
SIP error category: telephony_provider_permission_denied
INVITE response: 403 Forbidden

There is no Twilio call log for the failed outbound call.

Here is what I have already checked:

The number is imported into Retell as custom telephony / SIP trunking. The number is attached to the Twilio Elastic SIP Trunk. The Termination URI in Retell matches the Twilio SIP trunk Termination URI. The SIP username and password are the same credentials used for the working number. Outbound transport is set to TCP. The outbound provider/settings appear to match the working number. US and Canada calling are enabled. Inbound calling works, but outbound calling fails. I also tried a normal local number instead of a toll-free number, and it still failed. The working number and the broken number appear to use the same SIP trunk setup.

Because there is no Twilio call log, it seems like the call is failing before Twilio creates a normal call record, possibly at the SIP authentication/import/mapping layer.

What exactly should I check next? Could this be caused by the number not being correctly mapped on Retell’s side, even though the visible settings look correct? Is there any specific Retell-side setting for outbound provider, SIP trunk mapping, imported number configuration, or caller ID permission that would cause one imported Twilio number to work while another imported number with the same trunk/credentials gets a 403?

Could someone from Retell support please go into my account, check the configuration directly, and fix this or tell me exactly what setting is causing the issue?

Hey @ben.agent.ai

A 403 Forbidden on outbound (with no Twilio call log) most commonly comes from issues at Twilio’s SIP authentication/permission layer, not Retell-side mapping.

Specific things to check:

  1. Termination SIP URI — verify there’s no trailing/leading space, and use a localized termination URI near your region.

  2. SIP username/password — make sure you used the actual Credential List username, not the friendly name (they’re often different).

  3. Voice Geographic Permissions — in Twilio, search “geo”, select Elastic SIP Trunking, and confirm US/Canada (and any destination countries) are enabled for the trunk. This is a common cause of 403s even when account-level calling is enabled.

  4. IP ACL whitelist — confirm Retell’s SBC CIDR 18.98.16.120/30 is whitelisted on the trunk.

  5. Number actually attached to the trunk — re-open the Elastic SIP Trunk in Twilio and confirm the new number appears under the trunk’s Numbers tab (not just purchased on the account).

  6. Caller ID / header manipulation policy — if you’re using a verified caller ID policy, the new number must be in the same trunk for the From rewrite to apply.

Since both numbers share the same trunk/credentials and inbound works, the 403 strongly points to Twilio Voice Geographic Permissions or the number not actually being assigned to the trunk — Retell-side number mapping wouldn’t produce a 403 from Twilio.

Thank You

I checked all that and it is also set up correctly. Please fix it on your end do as much as you can to fix it I did everything I can on my side

Hi @ben.agent.ai

Can you share the Agent id and Call Ids where you get this error

Hi Retell Support,

I’m using a Retell AI phone number for outbound calls. The number was working earlier and I was able to make several outbound calls successfully.

However, after making another batch of outbound calls, the calls suddenly started failing. The failed calls show:

SIP status code: 403 Forbidden
Error category: telephony_provider_permission_denied
Error message: unexpected status from INVITE response: sip status: 403: Forbidden

The calls now fail immediately with 0-second duration.

Can you please check whether outbound calling has been blocked, restricted, rate-limited, or disabled on this Retell phone number or on the telephony provider side?

Can you please fix this issue so that I can make the calls normally?

This is urgent because outbound calls were working before and then suddenly all started failing.

Thank you.

Hey @ben.agent.ai

Could you please share the call IDs and the agent ID? Without this information, we won’t be able to investigate the issue further.

Thank you!

Just go on My Account and look at the most recent call log. You can easily find this yourself. Please please go ahead and fix the issue. just look at my call logs and look at the issue. You’ll see it right there.

@ben.agent.ai We haven’t received enough information yet for our team to investigate. Could you please share a recent failed call ID?

Information such as a call ID helps us investigate what happened on our side or what went wrong

Here is the call ID:
call_af6f2c83199fd4b6ec13a1c61d0

call_9a02c0d3f1911d7099e3418aa17
call_22dc9bb3df6090ec259a6b817dd
Etc

When can you fix this? It’s extremely urgent.

Hey @ben.agent.ai

I’ve escalated this to our team for further review.

We’ll update you as soon as we hear back.

Best regards

When can I receive an update? Like I said, it’s really urgent.

Your issue has been shared with our team. As soon as we receive a response, we’ll get back to you with an update.

Thank you for your patience!

Please expedite it and tell them it’s very urgent

Hey @ben.agent.ai

Team investigated all three calls and found the root cause: A SIP credential mismatch.

What’s happening: Twilio is returning error 32202 (“Authentication failure - bad user credentials”) on the outbound SIP INVITE. The SIP auth password stored in Retell for +18447563xxx is set to the same value as the username (retell-benslat), which Twilio is rejecting because it does not match the actual password in your trunk’s credential list.

Important clarification: The number that works (+16188511xxx) is a Retell-managed Twilio number. It does not go through the custom SIP trunk authentication path, which is why it succeeds even though the setup looks identical from your side. Your other custom number (+12524757xxx) has the same credential issue and also fails consistently.

To fix:

  1. Go to Twilio Console. Navigate to Elastic SIP Trunking > your trunk > Termination > Authentication.

  2. Find the credential list for username retell-benslat and note or reset the actual password.

  3. In Retell, update the SIP trunk password for both +18447563xxx and +12524757xxx with the correct password from Twilio.

  4. Retry an outbound call.

The username and termination URI are correct. Only the password needs to be updated.

Thank You