BYOC SIP trunk registration fails with 403 on Sydney edge during ACMA number validation

Trying to get the new BYOC SIP trunks live for the Melbourne site. Pushed the genesyscloud_telephony_providers_edges_sip_trunk resource via Terraform v1.47.2 to mypurecloud.com.au yesterday. Apply runs clean. Console shows the trunk as registered. Actual media flow is doing jack all though.

The SIP INVITE hits the Sydney edge and drops immediately. Edge logs are throwing a 403 Forbidden with error_code: EDGE_AUTH_TOKEN_EXPIRED. It’s weird because the auth token was generated fresh this morning. The timestamp format in the request header is using +00:00 UTC instead of +11:00 AEDT. ACMA compliance rules require the local timezone for call recording metadata, so the edge is rejecting the handshake before the prompt even plays.

Tried forcing the timezone offset in the Terraform config. Console still shows green. The softphone UI times out after 12 seconds. Latency to Sydney is sitting at 28ms, which is fine. The problem seems to be how the edge parses the X-ACMA-Compliance header during the initial SIP registration. Number porting data for the 03 prefix is correct in the directory.

Here is the exact payload the edge is rejecting:

{
 "status": 403,
 "code": "edge_auth_token_expired",
 "message": "Timestamp mismatch for ACMA recording window. Expected AEDT offset.",
 "traceId": "syd-edge-88f2a1b"
}

Updated the genesyscloud_edge_byoc module to inject the correct offset. Flow version 34 deploys without warnings. The SIP trunk still won’t register. Console says the media settings are active. The recording prompt never fires. Just hanging on the handshake.

Checking the raw SIP trace shows the P-Asserted-Identity is formatted as +613xxxxxx but the edge expects 03xxxxxx for local routing. Switched the number format in the provider config. Still getting the 403. The edge logs keep repeating the timestamp error. Maybe the BYOC edge cache isn’t flushing properly after the Terraform apply. Left it running for 45 minutes. Still stuck on the handshake.

Check your genesyscloud_telephony_providers_edges_edge config. The domain attribute needs to match the edge’s public DNS exactly, or the token validation fails. Also, ensure the sip_trunk resource references the correct edge_id. If the trunk is registered but media fails, it’s usually a NAT or firewall issue blocking RTP, not the API.