Authenticated browser API operations
Understand the logged-in state, directory, live, session, initiate, action, history, missed-read and presence operations and their method/permission rules.
Guides in this workflow
Follow the guide that matches the exact action, filter, menu change or issue.
Understand authenticated API context
Resolve either an authenticated administrator or client-contact context before returning phone data.
Understand administrator calling permission
Require Use internal calling for administrator API operations.
Read current phone state
Use the GET state operation to load settings, extension, active incoming call and API URLs.
Search the directory API
Use GET with q and optional limit; default limit is 20.
Read the Live now API
Use GET with optional limit; default limit is 100.
Create a browser SIP session
Use POST to receive the current authorised browser session credentials.
Initiate an internal call
Use POST with extension to request an authorised call.
Record a call action
Use POST with call UUID, supported action and optional reason.
Read call history
Use GET with optional limit; default limit is 25.
Mark missed calls read
Use POST with an array or JSON-encoded list of call UUIDs.
Update authenticated presence
Use POST with online true/false values.
Respect HTTP method restrictions
Use only the required GET or POST method; invalid methods return method-not-allowed.
Include current CSRF evidence
Use the returned/current CRM CSRF token for state-changing authenticated requests.
Handle authentication-required responses
Prompt the user to sign in when the API returns 401.
Handle permission or tenant-isolation responses
Do not retry around a 403; correct permission or ownership.
Handle validation responses
Correct extension, call action or request values after a 422 response.
Handle rate-limit responses
Wait and reduce request frequency after a 429 response.
Handle voice-engine unavailable responses
Restore gateway readiness before retrying a 503 response.