fix: improve RFC 3986 compliant percent-encoding for query strings and path segments

Update `QueryStringBuilder` to properly distinguish between three encoding
contexts — query keys, query values, and path segments — per RFC 3986.
Previously, only unreserved characters (A-Z, a-z, 0-9, `-`, `_`, `.`, `~`)
were left unencoded, causing over-encoding of characters that are safe in
query strings and path segments (e.g., `@`, `:`, `?`, `=` in values, etc.).

Path parameter strings in `ValueConvert.ToPathParameterString` now use the
new `EncodePathSegment` method instead of plain string passthrough, ensuring
path segments are correctly encoded per RFC 3986 pchar rules.

Key changes:
- Add `EncodePathSegment()` public method on `QueryStringBuilder` for RFC 3986 pchar-safe encoding
- Introduce `EncodingContext` enum (`QueryKey`, `QueryValue`, `Path`) to differentiate encoding rules
- Query values now allow `=`, `:`, `@`, `/`, `?`, and sub-delimiters (except `&`, `+`, `#`) unencoded
- Query keys allow the same set minus `=`; path segments allow unreserved + sub-delims + `:` + `@`
- `ValueConvert.ToPathParameterString(string)` now encodes path segments via `EncodePathSegment`
- Expand test coverage with new cases for path segment encoding, OData-style keys, and `+`/`=` handling

🌿 Generated with Fern

Author: fern-api[bot]

.fern/metadata.json

@@ -1,7 +1,7 @@
 {
-  "cliVersion": "4.62.4",
+  "cliVersion": "4.65.1",
   "generatorName": "fernapi/fern-csharp-sdk",
-  "generatorVersion": "2.55.3",
+  "generatorVersion": "2.58.0",
   "generatorConfig": {
     "namespace": "Vapi.Net",
     "client-class-name": "VapiClient",
@@ -12,6 +12,6 @@
     "simplify-object-dictionaries": true,
     "use-discriminated-unions": false
   },
-  "originGitCommit": "7353542e713a4907a187bb55b184fb955cb6c5e9",
-  "sdkVersion": "1.0.0"
+  "originGitCommit": "46b109d88752307f8952db91eaa642f61c3875b4",
+  "sdkVersion": "1.0.1"
 }

changelog.md

@@ -1,3 +1,22 @@
+## 1.0.1 - 2026-04-10
+* fix: improve RFC 3986 compliant percent-encoding for query strings and path segments
+* Update `QueryStringBuilder` to properly distinguish between three encoding
+* contexts — query keys, query values, and path segments — per RFC 3986.
+* Previously, only unreserved characters (A-Z, a-z, 0-9, `-`, `_`, `.`, `~`)
+* were left unencoded, causing over-encoding of characters that are safe in
+* query strings and path segments (e.g., `@`, `:`, `?`, `=` in values, etc.).
+* Path parameter strings in `ValueConvert.ToPathParameterString` now use the
+* new `EncodePathSegment` method instead of plain string passthrough, ensuring
+* path segments are correctly encoded per RFC 3986 pchar rules.
+* Key changes:
+* Add `EncodePathSegment()` public method on `QueryStringBuilder` for RFC 3986 pchar-safe encoding
+* Introduce `EncodingContext` enum (`QueryKey`, `QueryValue`, `Path`) to differentiate encoding rules
+* Query values now allow `=`, `:`, `@`, `/`, `?`, and sub-delimiters (except `&`, `+`, `#`) unencoded
+* Query keys allow the same set minus `=`; path segments allow unreserved + sub-delims + `:` + `@`
+* `ValueConvert.ToPathParameterString(string)` now encodes path segments via `EncodePathSegment`
+* Expand test coverage with new cases for path segment encoding, OData-style keys, and `+`/`=` handling
+* 🌿 Generated with Fern
+
 ## 1.0.0 - 2026-04-07
 * The `CallControllerFindAllPaginatedRequest` request class and the associated `CallControllerFindAllPaginatedRequestSortOrder` enum have been removed from the SDK. If your code references either of these types, you will need to update it accordingly. Please refer to the latest API documentation for the replacement request model.
 * The following public types have been removed: `GenerateStructuredOutputSuggestionsDto`, `UpdateSupabaseCredentialDto`, and the `CreateVoicemailToolDtoType` enum. Additionally, `AnalyticsClient.GetAsync` now returns `WithRawResponseTask<IEnumerable<AnalyticsQueryResult>>` instead of `Task<IEnumerable<AnalyticsQueryResult>>`; callers must update to await `.Data` or use the `.WithRawResponse()` accessor. The `AnalyticsClient` now implements `IAnalyticsClient`.

src/Vapi.Net.Test/Core/QueryStringBuilderTests.cs

@@ -46,7 +46,7 @@ public void Build_SpecialCharacters()
         Assert.That(
             result,
             Is.EqualTo(
-                "?email=test%40example.com&url=https%3A%2F%2Fexample.com%2Fpath%3Fquery%3Dvalue&special=a%2Bb%3Dc%26d"
+                "?email=test@example.com&url=https://example.com/path?query=value&special=a%2Bb=c%26d"
             )
         );
     }
@@ -159,7 +159,7 @@ public void Build_ReservedCharacters_NotEncoded()
 
         var result = QueryStringBuilder.Build(parameters);
 
-        // Unreserved characters: A-Z a-z 0-9 - _ . ~
+        // Safe query characters include RFC 3986 unreserved + sub-delimiters (except & = +) + : @ /
         Assert.That(result, Is.EqualTo("?path=some-path&id=123-456_789.test~value"));
     }
 
@@ -557,4 +557,102 @@ public void Builder_Set_WithCollection_ReplacesAllPreviousValues()
         Assert.That(result, Does.Not.EndWith("id=1"));
         Assert.That(result, Does.Not.EndWith("id=2"));
     }
+
+    [Test]
+    public void EncodePathSegment_UnreservedChars_NotEncoded()
+    {
+        var result = QueryStringBuilder.EncodePathSegment("hello-world_test.value~123");
+        Assert.That(result, Is.EqualTo("hello-world_test.value~123"));
+    }
+
+    [Test]
+    public void EncodePathSegment_SubDelimiters_NotEncoded()
+    {
+        // All sub-delimiters are safe in path segments per RFC 3986
+        var result = QueryStringBuilder.EncodePathSegment("a!b$c&d'e(f)g*h+i,j;k=l");
+        Assert.That(result, Is.EqualTo("a!b$c&d'e(f)g*h+i,j;k=l"));
+    }
+
+    [Test]
+    public void EncodePathSegment_ColonAndAt_NotEncoded()
+    {
+        var result = QueryStringBuilder.EncodePathSegment("user@host:8080");
+        Assert.That(result, Is.EqualTo("user@host:8080"));
+    }
+
+    [Test]
+    public void EncodePathSegment_SlashAndQuestion_Encoded()
+    {
+        // "/" and "?" are NOT part of pchar, so they must be encoded in path segments
+        var result = QueryStringBuilder.EncodePathSegment("path/with?query");
+        Assert.That(result, Is.EqualTo("path%2Fwith%3Fquery"));
+    }
+
+    [Test]
+    public void EncodePathSegment_Space_Encoded()
+    {
+        var result = QueryStringBuilder.EncodePathSegment("hello world");
+        Assert.That(result, Is.EqualTo("hello%20world"));
+    }
+
+    [Test]
+    public void EncodePathSegment_EmptyAndNull()
+    {
+        Assert.That(QueryStringBuilder.EncodePathSegment(""), Is.EqualTo(""));
+        Assert.That(QueryStringBuilder.EncodePathSegment(null!), Is.Null);
+    }
+
+    [Test]
+    public void Build_QueryKeyVsValue_DifferentEncoding()
+    {
+        // "=" is safe in query values but NOT in query keys
+        var parameters = new List<KeyValuePair<string, string>>
+        {
+            new("key=with=equals", "value=with=equals"),
+        };
+
+        var result = QueryStringBuilder.Build(parameters);
+
+        // Key: "=" must be encoded
+        // Value: "=" is safe (part of query value safe chars)
+        Assert.That(result, Is.EqualTo("?key%3Dwith%3Dequals=value=with=equals"));
+    }
+
+    [Test]
+    public void Build_QueryValue_QuestionMarkNotEncoded()
+    {
+        // "?" is safe in both query keys and query values per RFC 3986
+        var parameters = new List<KeyValuePair<string, string>> { new("q?key", "is this?") };
+
+        var result = QueryStringBuilder.Build(parameters);
+
+        Assert.That(result, Is.EqualTo("?q?key=is%20this?"));
+    }
+
+    [Test]
+    public void Build_QueryKey_PlusEncoded()
+    {
+        // "+" must be encoded in both query keys and query values
+        var parameters = new List<KeyValuePair<string, string>> { new("a+b", "c+d") };
+
+        var result = QueryStringBuilder.Build(parameters);
+
+        Assert.That(result, Is.EqualTo("?a%2Bb=c%2Bd"));
+    }
+
+    [Test]
+    public void Build_ODataFilter_DollarPreserved()
+    {
+        // "$" is safe in query keys (sub-delimiter), verifies OData-style parameters work
+        var parameters = new List<KeyValuePair<string, string>>
+        {
+            new("$filter", "status eq 'active'"),
+            new("$top", "10"),
+        };
+
+        var result = QueryStringBuilder.Build(parameters);
+
+        Assert.That(result, Does.Contain("$filter=status%20eq%20'active'"));
+        Assert.That(result, Does.Contain("$top=10"));
+    }
 }

src/Vapi.Net.Test/Core/RawClientTests/QueryParameterTests.cs

@@ -27,7 +27,7 @@ public void QueryParameters_SpecialCharacterEscaping()
             .Add("space test", "hello world")
             .Build();
 
-        Assert.That(queryString, Does.Contain("email=bob%2Btest%40example.com"));
+        Assert.That(queryString, Does.Contain("email=bob%2Btest@example.com"));
         Assert.That(queryString, Does.Contain("%25Complete=100"));
         Assert.That(queryString, Does.Contain("space%20test=hello%20world"));
     }

src/Vapi.Net/Core/Public/Version.cs

@@ -3,5 +3,5 @@ namespace Vapi.Net;
 [Serializable]
 internal class Version
 {
-    public const string Current = "1.0.0";
+    public const string Current = "1.0.1";
 }