Exchange a connection code for a device credential
Unauthenticated by design: the connection code IS the credential, which is what lets the agent app have no sign-in screen at all. Returns a long-lived per-device secret, shown ONCE, which the device then presents to mint short-lived WebRTC tokens and to heartbeat presence.
Every failure except a full line answers devices.code_invalid without saying why — distinguishing expired from unknown from already-used would turn this into an oracle for whether six digits ever existed.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
curl -X POST "https://example.com/v1/devices/enroll" \ -H "Content-Type: application/json" \ -d '{ "code": "string" }'{ "device_id": "3bafab7b-4400-4bcf-8e6e-09f954699940", "device_secret": "string", "client_name": "string", "extension": "string", "phone_number": "string"}Token revocation endpoint POST
RFC 7009. Always 200, whether or not the token existed.
Mint a WebRTC token for this device POST
Authenticated with the device secret. The PBX identity is taken from the device record — a caller-supplied name is ignored, so a device cannot mint a token that rings as a colleague. Tokens are short-lived (about an hour); refresh on launch and on returning to the foreground.