openai-python 3.42.0 and openai-node 7.46/7.47: agent compaction and review settings, external keys, SIP DTMF

openai-python v3.42.0 and openai-node v7.46.0/v7.47.0 all shipped on 2026-10-31: python and node landed the same API surface the same day — agent-session context-compaction settings, an action-review mode, and a session-level spend cap; experimental time awareness; a five-endpoint external-key surface under the organization admin namespace; SIP DTMF send and receive over Live sideband; typed WebSocket warmup with per-sender delivery receipts; and a markup overlay for image edits. Every parameter name, enum value, and docstring quote below comes from the two repos' tag sources (checked 2026-11-01) — not from release-note titles.

1. Versions and publish state

The publish timeline (checked 2026-11-01 via the GitHub API and the PyPI/npm registries):

python v3.42.0 carries 13 commits across 87 changed files; node v7.46.0 carries 17 commits, and v7.47.0 just 2, touching the two Responses client files — a standalone release whose purpose is to get one type field out quickly (see section 6). The two packages' feature sets align day-for-day: this is one API batch released to both SDKs. The node-only entries (typed Realtime references #3081, hosted tool usage #3071, sessions metadata filtering #3070, local parsing #3079) are node-side catch-up for capabilities python shipped in v3.41.0.

2. Agent sessions: compaction, review, and a spend cap

The session-create params (src/openai/types/beta/agents/session_create_params.py) gain three session-level settings:

compaction (how context gets compacted): an object with a single boolean field, async. The docstring: omitted or null defaults to true (background compaction); set to false to use blocking compaction, and it notes Background compaction may increase token usage. After the session starts, the new read-only compaction field on the agent object (Agent.Compaction) reports the effective setting.

review (the action-review mode): Literal["none", "auto_review"]. The type file's own wording — none keeps the existing execution behavior without automatic action review; auto_review is Review eligible actions automatically. Deny manual approval fallbacks.

spend_control (a session spend cap): an optional object whose limit is required — a positive integer of USD cents, or null; omitting the field or setting null creates an unlimited session. The type layer says nothing about what happens when the cap is hit.

from openai import OpenAI

client = OpenAI()

session = client.beta.agents.sessions.create(
    environment={"type": "openai_hosted"},
    agent={
        "model": "gpt-6.1-sol",
        "compaction": {"async": False},           # blocking compaction (default true = background)
        "experimental": {"time_awareness": True},  # experimental time awareness
        "service_tier": "ultrafast",               # joins the enum this release
    },
    review="auto_review",
    spend_control={"limit": 50000},                # cap of $500.00 (unit: USD cents)
)

The same params also accept vault_ids (the vault IDs made available to this session), and the tools docstring in the agent config notes the resolved tool list must fit within 3 MiB (3,145,728 bytes) of compact UTF-8 JSON.

3. Experimental time awareness

The Agent object (src/openai/types/beta/agent.py) gains a read-only experimental: Experimental field containing the boolean switch time_awareness. Both docstrings agree: whether the model receives periodic current-time reminders. The release notes flag the whole group as experimental (add experimental agent time awareness); the field itself is a plain boolean with no extra gating parameter.

It sits alongside the existing multi_agent (v2) config in the agent configuration, and the service_tier enum grows from auto/default/flex/priority/fast to six values this release — the new ultrafast corresponds to the official changelog's 2026-10-16 Agents API Ultrafast entry (set agent.service_tier to ultrafast).

4. Organization external key management

client.admin.organization.external_keys is the batch's only new resource surface, with five endpoints (api.md, 2026-10-31 edition):

Key fields of the ExternalKey type (src/openai/types/admin/organization/external_key.py): purpose is Literal["ekm", "psp_decryption"]; cloud fields come in three groups — AWS kms_arn / role_arn / kms_key_location, GCP kms_key_ring_name / kms_project_id / workload_identity_pool_id / workload_identity_project_number / workload_identity_provider_id, Azure tenant_id / vault_uri / key_name / key_version. The official semantics of ekm (external key management) and psp_decryption (payment-service-provider decryption) are not in the type layer; this site does not speculate.

The release-note title is add organization external key management (#4205 python / #3073 node). It coexists with client.api_keys (OpenAI-issued calling credentials); nothing in the type layer describes a replacement or migration.

5. SIP DTMF: a sideband send command plus a server-side received event

DTMF (telephone keypad signaling) gets both directions in this batch:

Sending: the Live sideband connection gains the transport.dtmf.send event (in the SDK, the transport.dtmf resource on a SidebandConnection, with a send() method). Docstring: Send one DTMF keypress to the SIP trunk through a Live sideband connection. This command is supported only for SIP calls. A successful send emits transport.dtmf.sent on sideband. If you provide event_id, the success notification includes it as client_event_id; a failure includes it as error.client_event_id. Send separate events for multiple keypresses.

# Send one DTMF keypress over a Live sideband connection (SIP calls only)
connection.transport.dtmf.send(event="5", event_id="press-1")

Receiving: the Realtime server events gain input_audio_buffer.dtmf_event_received (src/openai/types/realtime/input_audio_buffer_dtmf_event_received_event.py), docstring marked SIP Only — the telephone keypad the user pressed (0-9, *, #, A-D), where event is the key character and received_at is the UTC Unix timestamp of when the server received the event.

6. WebSocket: warmup gets typed, the queue gets receipts

Warmup: node v7.47.0 (release note: support typed Responses WebSocket warmup, #3084) adds generate?: boolean to the response.create client event. Docstring: Whether to generate output for this response. Defaults to true when omitted. Set to false to prepare request state without model output; the response ID can be used as previous_response_id on a later turn. On the python side, the v3.42.0 responses_websocket README already described the pattern (using existing extra-field support: build the ResponseCreate event with generate=False, send it with lane.send(), collect the terminal response with lane.get_final_response(), then use the response ID as previous_response_id); the python release-note entry is support WebSocket warmup and preserve cleanup cancellation (#4215).

Delivery receipts: python #4213 (improve WebSocket recovery and delivery reporting) reworks _send_queue.py — a new SendReceipt class, docstring An admitted ordinary sender's own failure, if another caller sends it, with raise_if_failed() and raise_if_unsent() queries; queue entries become three-tuples (data, byte length, receipt). The strongest evidence for the semantic change is the rewritten reconnect test, whose new comment reads: A failed flush consumes its attempt, so both queued sends are attempted before recovery succeeds on the third socket. Neither is replayed. — attempted-but-undelivered messages are no longer silently replayed across reconnect attempts; outcomes go back to the senders via receipts. enqueue() also gains an only_if_pending conditional form (declines without allocating a UTF-8 copy when the queue is empty; a test asserts the zero-allocation path).

The node-side entries are v7.46.0's #3081 (add typed Realtime references and improve WebSocket delivery) and #3059 (realtime: honor the selected WebSocket session target, a fix); the new src/internal/realtime-credentials.ts routes openai-organization.<id> / openai-project.<id> metadata through WebSocket subprotocols.

7. Image-edit markup overlays, and GPT Image 2.6's first appearance

images.edit (src/openai/types/image_edit_params.py) gains a markup parameter (typed FileTypes), docstring: A transparent PNG overlaid on the first image to guide the edit. Must match that image's dimensions after orientation and contain transparent pixels. Supports GPT Image 2.5 and 2.6. Cannot be combined with mask.

The notable part is GPT Image 2.6: as of the 2026-11-01 check, neither the official changelog nor the model catalog has a standalone entry or model card for it — this docstring is the model name's first appearance in a fetchable official channel (the SDK type layer). This site records the appearance as a fact and does not infer pricing or availability.

8. Mid-session format switching, local parsing, and per-request API keys

configuration_update gains text: the identically named configuration_update input-item types (Responses and beta) each gain a text field — Text.format is the union ResponseFormatText | ResponseFormatTextJSONSchemaConfigParam, docstring: Use a JSON schema for structured output or text to return to plain text; the item description expands from reasoning-only to Supply reasoning, text, or both. Each setting stays in effect until a later update replaces it. In other words, an ongoing conversation can now switch its subsequent output format mid-session.

Local parsing: python's responses.parse gains a parse_as parameter (a type[TextFormatT] | None overload), and ParsedResponseOutputText.parsed adds a __api_exclude__ serialization exclusion; the node counterpart is #3079 (parse Responses using the latest text format update), where the parseAs docstring reads: Parse with this format without sending it to the API.

Callable API key scoping: #4216 (keep callable API keys scoped to each request) lands in _client_auth.py — a new _set_request_api_key() moves key resolution down to the individual request: an explicit Authorization override on the request (including Omit sentinels and case variants) is left fully intact; otherwise the Bearer header is filled from the key resolved for that request. Clients constructed with a callable API key previously had the resolution timing decided at the client layer; as of this release it is scoped to each request.

9. Upgrade notes and pitfalls

• All three releases are routine minors (python 3.41→3.42, node 7.45.1→7.46→7.47); the release notes flag no breaking changes. Jumping node straight from 7.45.1 to 7.47.0 also picks up the #3059 session-target fix.
• spend_control.limit is in USD cents — 50000 means $500, not fifty thousand dollars; the type layer does not describe over-limit behavior, so do not bet production on it.
• review="auto_review" denies manual approval fallbacks (docstring wording); applications with human-approval pipelines should confirm that semantics before upgrading.
• DTMF sending is supported only for SIP calls; sending transport.dtmf.send on a WebRTC session is outside the documented support.
• The markup overlay and mask are mutually exclusive, and the overlay's size baseline is the orientation-corrected image — align your EXIF preprocessing with the overlay.
• GPT Image 2.6 exists only in a type docstring; it is not in the model catalog or on the pricing page yet — keep it out of default model names.

10. Next steps

• The previous SDK batch (breakpoint TTL semantics, Response.tool_usage, Realtime item references): openai-python 3.40/3.41 and openai-node 7.45.1: breakpoint TTL semantics, tool_usage, and Realtime item references.
• The agent environments foundation (prewarming, suspension/expiration events): Hosted agent environments surface in the OpenAI SDKs: prewarmed creation, idle suspension, expiration.
• The compaction event surface (compaction_trigger and response.compaction.compacting): The Responses API Compaction Progress Event: response.compaction.compacting and compaction_trigger.
• Recent official changelog entries (GPT-6 Rosalind, subscription API credits, 12-hour caching): OpenAI's October changelog, backfilled: GPT-6 Rosalind, ChatGPT subscription API credits, and 12-hour prompt caching.