API Reference
Calls

Send a control command to a conference room on the PBX

POST
/v1/conferences/{room_name}/commands

Dispatches one of the allowlisted PBX conference commands (kill, mute, unmute, tmute, deaf, undeaf, kick, hup, lock, unlock, hold, unhold, play, dtmf, relate) to the named room. The room must belong to the active workspace. Unknown commands are rejected with 400.

Authorization

bearerAuth
AuthorizationBearer <token>

Long-lived ES256 JWT minted from the dashboard (https://app.sautikit.com/developers/api-keys). Signed by the platform keyring. Carries workspace_id and scopes claims; revoked via the platform deny-list.

In: header

Path Parameters

room_name*string

Conference room name as registered with the PBX.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/conferences/string/commands" \  -H "Content-Type: application/json" \  -d '{    "command": "mute",    "participant": "p-a1b2c3d4-e5f6-7890-abcd-ef1234567890"  }'
{  "status": "ok"}
{  "error": {    "code": "validation.bad_request",    "message": "string",    "request_id": "string"  }}
{  "error": {    "code": "validation.bad_request",    "message": "string",    "request_id": "string"  }}
{  "error": {    "code": "calls.forbidden",    "message": "conference room does not belong to this workspace",    "request_id": "req-b2c3d4e5"  }}
{  "error": {    "code": "validation.bad_request",    "message": "string",    "request_id": "string"  }}

Mint a short-lived WebRTC PBX token for the browser softphone POST

Requests a workspace-scoped WebRTC bearer token from the PBX. The token is returned as-is from the PBX; the caller passes it to the in-browser softphone SDK to register. Short-lived (typically 60–300 s); renew before expiry. Optional body fields (`client_name`, `role`) are forwarded to the PBX and reflected in token claims; both may be omitted. Every body field is optional, but the request body itself must be valid JSON — send at least `{}` (an empty body is rejected 400 `validation.bad_request`). To bind the token to one of your DIDs (so the WebRTC session routes through that number), pass **either** `tenant_number_id` (the internal number id) **or** `phone_number` (the DID in E.164). The backend resolves the number's PBX sip-profile and embeds it as the token's `sip.id` claim. Omit both to mint a non-DID-bound token, in which case the PBX assigns `sip.id` `"default"`. When both are supplied, `tenant_number_id` wins.

List webhook subscriptions for the active workspace GET

Next Page