{ "info": { "name": "Hello by Flow API", "description": "The Hello by Flow API powers a multi-tenant cloud calling SaaS platform: external Twilio\nvoice & SMS, free internal Team Chat, peer-to-peer WebRTC meetings, agent dashboards,\nand a platform-owner console for managing customer organizations.\n\n## Authentication\n\nTwo equivalent auth schemes are supported on every protected endpoint:\n\n| Scheme | How |\n|---|---|\n| **`access_token` cookie** | Set automatically by `POST /api/auth/login`. Sent with every same-site request. |\n| **`Authorization: Bearer `** | Use the `access_token` field returned by `/auth/login` (12-hour TTL). |\n\nThe token encodes the user id and role; org scoping is enforced server-side via\nthe `org_scope(user)` helper in `middleware/auth.py`.\n\n## Roles\n\n| Role | Visibility |\n|---|---|\n| `owner` | Cross-org \u2014 runs `/api/owner/*` platform console. |\n| `admin` | Full control of own organization. |\n| `supervisor` | Read-only across org (calls, recordings, analytics). |\n| `agent` | Only their own contacts / calls / SMS. |\n\n## Errors\n\nAll errors use the FastAPI default `{ \"detail\": \"...\" }` envelope. Status codes follow\nHTTP semantics: 400 (validation), 401 (no auth), 403 (wrong role), 404 (not found / not\nvisible), 429 (lockout), 503 (Twilio/LLM down). See per-endpoint `responses` for the\nexact failure modes.\n\n## Multi-tenancy\n\nEvery persisted document carries an `org_id`. Non-owner queries are automatically\nscoped to the caller's org. Agent-role users see only their own rows.", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json", "_postman_id": "vocalis-api-collection", "version": "1.0.0" }, "variable": [ { "key": "baseUrl", "value": "http://localhost:8001", "type": "string" }, { "key": "accessToken", "value": "", "type": "string", "description": "Paste the access_token returned by POST /api/auth/login." } ], "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] }, "event": [ { "listen": "prerequest", "script": { "type": "text/javascript", "exec": [ "// Auto-login if accessToken is empty and credentials are set", "if (!pm.collectionVariables.get('accessToken') && pm.environment.get('email')) {", " pm.sendRequest({", " url: pm.collectionVariables.get('baseUrl') + '/api/auth/login',", " method: 'POST',", " header: { 'Content-Type': 'application/json' },", " body: { mode: 'raw', raw: JSON.stringify({", " email: pm.environment.get('email'),", " password: pm.environment.get('password')", " }) }", " }, (err, res) => {", " if (!err && res.code === 200) {", " pm.collectionVariables.set('accessToken', res.json().access_token);", " }", " });", "}" ] } } ], "item": [ { "name": "AI", "description": "AI features \u2014 Vox support chatbot (Claude Sonnet 4.5).", "item": [ { "name": "Chat with Vox \u2014 the Hello by Flow AI support assistant", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/support/chat", "host": [ "{{baseUrl}}" ], "path": [ "api", "support", "chat" ] }, "description": "Public endpoint (no auth). Pass a stable `session_id` to maintain conversation history across messages \u2014 Vox keeps the last 10 turns. Powered by Claude Sonnet 4.5 via the Emergent LLM key.", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "response": [] }, { "name": "Retrieve a Vox conversation history", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/support/history/{session_id}", "host": [ "{{baseUrl}}" ], "path": [ "api", "support", "history", "{session_id}" ] }, "description": "Returns up to all messages for the given session (user + assistant). Public \u2014 no auth." }, "response": [] } ] }, { "name": "Admin", "description": "Platform-owner console \u2014 list/approve/suspend/delete tenant organizations and view revenue stats.", "item": [ { "name": "30-day rollup of counts by severity + top event types", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/security/summary", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "security", "summary" ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Add a recipient (sends verification email)", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/digest/recipients", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "digest", "recipients" ] }, "description": "Adds the email as `pending`, generates a verification token, and sends/queues a verification email containing the link. The recipient is **not** mailed any digests until they click that link. If RESEND_API_KEY is not set, the email is queued to `email_outbox` and a copy of the verification URL is returned in `verify_url` so the owner can deliver it out-of-band.", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } }, "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Approve a pending/intent org (owner only)", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/orgs/{org_id}/approve", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "orgs", "{org_id}", "approve" ] }, "description": "Owner-approve manually provisions an organisation. Two paths:\n\n1. `status=\"intent\"` \u2014 the org came in through the Signup-Intent funnel\n but hasn't paid yet. Owner-approve treats this as a comped account:\n routes through `finalize_intent()` so the org is activated AND the\n Communication Seats are provisioned (empty `virtual_numbers` rows in\n `lifecycle_state=\"purchased\"`), exactly like a successful Stripe\n payment would have. The admin then walks the WelcomeWizard the\n moment they log in.\n\n2. `status=\"pending\"` \u2014 a legacy signup awaiting review. Just flips the\n status to `active` and stamps `kyc_status=\"approved\"`.\n\nEither way the welcome email fires afterwards.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Begin impersonating a user (owner only) \u2014 swaps the active session cookies", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/users/{user_id}/impersonate", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "users", "{user_id}", "impersonate" ] }, "description": "Swaps the caller's HttpOnly auth cookies to a new pair authenticating AS the target user. The owner's previous session is preserved on the frontend via a special `owner_resume_token` cookie so the 'Exit impersonation' button can restore them in one click. Every impersonation is audit-logged.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Clear the customer login-lockout counter for a user (owner)", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/security/remediate/unlock-user/{user_id}", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "security", "remediate", "unlock-user", "{user_id}" ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Clear the internal-staff lockout counter for a staff account (owner)", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/security/remediate/unlock-staff/{staff_id}", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "security", "remediate", "unlock-staff", "{staff_id}" ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Compute the current weekly digest (no save, no mail)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/digest/preview", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "digest", "preview" ] }, "description": "Returns the same dict that would be emailed if you clicked Send Now. Use this for the live dashboard preview.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Compute, mail, and persist the digest now", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/digest/send-now", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "digest", "send-now" ] }, "description": "Generates a fresh digest, mails it to every verified recipient (plus the owner), records the run in `digest_history`, and writes an audit log row. Returns the run record.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Create an organization manually (owner only)", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/orgs", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "orgs" ] }, "description": "Bypass-KYC creation path used by the platform owner to onboard customers via direct contracts.", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } }, "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Cross-tenant data-integrity scan (owner only)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/data-integrity", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "data-integrity" ] }, "description": "Walks every organization in the platform and counts data-integrity signals: SMS records pointing to deleted contacts (`stale_contact_links`), call records pointing to deleted contacts (`stale_call_contact_links`), and meetings whose organizer/participants reference deleted users (`stale_meeting_user_refs`). Returns per-org counts plus a `worst` list sorted by total issues descending. Use the heal endpoint to auto-null those references so they surface as orphans / unknown in the per-tenant UI.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Cross-tenant search (owner only)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/search", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "search" ], "query": [ { "key": "q", "value": "", "disabled": true, "description": "" } ] }, "description": "Searches users (name/email), contacts (name/phone), virtual numbers, and orgs by name. Returns up to 50 matches across all tenants.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Delete the Veriff record from every collection (owner only)", "request": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/kyc/veriff/reset", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "kyc", "veriff", "reset" ] }, "description": "Nukes any existing Veriff entry from provider_configs, custom_providers, and provider_registry \u2014 so the operator can re-register via the Marketplace form without the 'already exists' block. Idempotent.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Download a digest run as CSV", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/digest/history/{run_id}/csv", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "digest", "history", "{run_id}", "csv" ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Download a digest run as PDF", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/digest/history/{run_id}/pdf", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "digest", "history", "{run_id}", "pdf" ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Download filtered events as CSV (Excel-friendly)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/security/events.csv", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "security", "events.csv" ], "query": [ { "key": "q", "value": "", "disabled": true, "description": "" }, { "key": "org_id", "value": "", "disabled": true, "description": "" }, { "key": "actor_id", "value": "", "disabled": true, "description": "" }, { "key": "target_id", "value": "", "disabled": true, "description": "" }, { "key": "event_types", "value": "", "disabled": true, "description": "" }, { "key": "severities", "value": "", "disabled": true, "description": "" }, { "key": "outcomes", "value": "", "disabled": true, "description": "" }, { "key": "since", "value": "", "disabled": true, "description": "" }, { "key": "until", "value": "", "disabled": true, "description": "" } ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Download filtered events as a Hello by Flow-branded PDF report", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/security/events.pdf", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "security", "events.pdf" ], "query": [ { "key": "q", "value": "", "disabled": true, "description": "" }, { "key": "org_id", "value": "", "disabled": true, "description": "" }, { "key": "actor_id", "value": "", "disabled": true, "description": "" }, { "key": "target_id", "value": "", "disabled": true, "description": "" }, { "key": "event_types", "value": "", "disabled": true, "description": "" }, { "key": "severities", "value": "", "disabled": true, "description": "" }, { "key": "outcomes", "value": "", "disabled": true, "description": "" }, { "key": "since", "value": "", "disabled": true, "description": "" }, { "key": "until", "value": "", "disabled": true, "description": "" }, { "key": "label", "value": "", "disabled": true, "description": "Report title shown on the PDF cover" } ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Edit any user across the platform (owner only)", "request": { "method": "PATCH", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/users/{user_id}", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "users", "{user_id}" ] }, "description": "Patch `name`, `email`, `role`, or `deleted` (soft delete flag) on any user in any org. Writes an audit entry.", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } }, "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Emergency-disable a customer user (owner)", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/security/remediate/disable-user/{user_id}", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "security", "remediate", "disable-user", "{user_id}" ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Export full org data as JSON (owner only)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/orgs/{org_id}/export", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "orgs", "{org_id}", "export" ] }, "description": "Returns the entire org's persisted state (org doc + every collection scoped to org_id) as a single JSON document. Use for GDPR data-subject requests or backup before deletion.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Filter facets for the events UI (orgs, actors, event types)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/security/facets", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "security", "facets" ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Force a user to change their password at next login (owner only)", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/users/{user_id}/force-password-change", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "users", "{user_id}", "force-password-change" ] }, "description": "Sets `must_change_password`, revokes every session and invalidates live tokens. The user must sign in and immediately set a new password before using the app.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Force-logout a user everywhere (owner only)", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/users/{user_id}/force-logout", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "users", "{user_id}", "force-logout" ] }, "description": "Revokes every refresh session and invalidates all live access tokens via a session-epoch bump. The user must sign in again on every device.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Force-reset a user's password (owner only)", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/users/{user_id}/reset-password", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "users", "{user_id}", "reset-password" ] }, "description": "Owner sets a new password for any user. The user is **not** notified by email \u2014 owner must communicate the temp password out-of-band. Logged in the audit trail.", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } }, "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Get a single org with its users (owner only)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/orgs/{org_id}", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "orgs", "{org_id}" ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Get the owner's digest schedule", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/digest/schedule", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "digest", "schedule" ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Growth & conversion analytics (owner only)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/growth/funnel", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "growth", "funnel" ], "query": [ { "key": "from", "value": "", "disabled": true, "description": "" }, { "key": "to", "value": "", "disabled": true, "description": "" }, { "key": "country", "value": "", "disabled": true, "description": "" }, { "key": "currency", "value": "", "disabled": true, "description": "" }, { "key": "plan", "value": "", "disabled": true, "description": "" }, { "key": "gateway", "value": "", "disabled": true, "description": "" }, { "key": "source", "value": "", "disabled": true, "description": "" }, { "key": "device", "value": "", "disabled": true, "description": "" } ] }, "description": "Single payload returning: filtered funnel steps, KPI tiles, top performers by country/currency/plan/gateway, and a daily revenue trend. All filters are optional; omit them to get the platform-wide view. Steps for which we don't yet collect events (visitors, email verified, marketing source) are returned with `future_ready: true` so the UI can render a placeholder instead of a misleading zero.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Hard-delete an organization + all its data (owner only)", "request": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/orgs/{org_id}", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "orgs", "{org_id}" ] }, "description": "Cascade-deletes users, contacts, calls, recordings, SMS, virtual numbers, and IVR flows.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Introspect the Veriff configuration (owner only)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/kyc/veriff/status", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "kyc", "veriff", "status" ] }, "description": "Reports which Mongo collection Veriff was found in, whether api_key / shared_secret / base_url resolved to non-empty values, and what the effective base URL will be. Never returns the secret values themselves \u2014 just booleans + last-4 of the API key.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "List all IVR flows of an org (owner)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/orgs/{org_id}/ivr", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "orgs", "{org_id}", "ivr" ], "query": [ { "key": "limit", "value": "", "disabled": true, "description": "" } ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "List all SMS of an org (owner)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/orgs/{org_id}/sms", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "orgs", "{org_id}", "sms" ], "query": [ { "key": "limit", "value": "", "disabled": true, "description": "" } ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "List all calls of an org (owner)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/orgs/{org_id}/calls", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "orgs", "{org_id}", "calls" ], "query": [ { "key": "limit", "value": "", "disabled": true, "description": "" } ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "List all contacts of an org (owner)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/orgs/{org_id}/contacts", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "orgs", "{org_id}", "contacts" ], "query": [ { "key": "limit", "value": "", "disabled": true, "description": "" } ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "List all meetings of an org (owner)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/orgs/{org_id}/meetings", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "orgs", "{org_id}", "meetings" ], "query": [ { "key": "limit", "value": "", "disabled": true, "description": "" } ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "List all recordings of an org (owner)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/orgs/{org_id}/recordings", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "orgs", "{org_id}", "recordings" ], "query": [ { "key": "limit", "value": "", "disabled": true, "description": "" } ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "List all users of an org (owner)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/orgs/{org_id}/users", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "orgs", "{org_id}", "users" ], "query": [ { "key": "limit", "value": "", "disabled": true, "description": "" } ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "List all virtual numbers of an org (owner)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/orgs/{org_id}/numbers", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "orgs", "{org_id}", "numbers" ], "query": [ { "key": "limit", "value": "", "disabled": true, "description": "" } ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "List all voicemails of an org (owner)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/orgs/{org_id}/voicemails", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "orgs", "{org_id}", "voicemails" ], "query": [ { "key": "limit", "value": "", "disabled": true, "description": "" } ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "List digest recipients", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/digest/recipients", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "digest", "recipients" ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "List every customer organization (platform owner only)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/orgs", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "orgs" ] }, "description": "Returns all orgs with user/call counts and computed monthly charge. KYC media is excluded.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "List every feature flag currently set (owner only)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/feature-flags", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "feature-flags" ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Org deep snapshot (owner only)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/orgs/{org_id}/deep", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "orgs", "{org_id}", "deep" ] }, "description": "Comprehensive overview of a single tenant: org metadata, all team members (with last_active timestamps inferred from latest call / sms / meeting), counts of every resource (contacts, calls, recordings, sms, meetings, voicemails, numbers), and quick billing snapshot (MRR + plan).", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Owner audit log (owner only)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/audit-log", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "audit-log" ], "query": [ { "key": "org_id", "value": "", "disabled": true, "description": "" }, { "key": "action", "value": "", "disabled": true, "description": "" }, { "key": "actor_id", "value": "", "disabled": true, "description": "" }, { "key": "limit", "value": "", "disabled": true, "description": "" } ] }, "description": "Returns the immutable trail of every privileged owner action (org edits, user edits, password resets, impersonation, deletes, exports, data-integrity heals). Filter by `org_id`, `action`, or `actor_id`.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Platform revenue summary (owner only)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/revenue", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "revenue" ] }, "description": "Computes MRR/ARR across active orgs, broken down by plan tier. Prices are pulled LIVE from Stripe (source of truth) \u2014 never hardcoded. Paying-seat counts use `seats_total` (the quantity we actually bill in Stripe), so managerial-only admins who haven't purchased their own Communication Seat are correctly excluded.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Platform-wide activity feed (owner only)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/activity", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "activity" ], "query": [ { "key": "org_id", "value": "", "disabled": true, "description": "" }, { "key": "type", "value": "", "disabled": true, "description": "call|sms|meeting|contact|user|audit" }, { "key": "q", "value": "", "disabled": true, "description": "substring filter on summary" }, { "key": "limit", "value": "", "disabled": true, "description": "" } ] }, "description": "Merged time-sorted activity across every organization: calls, SMS, meetings, new contacts, user signups, owner audit actions. Each row is normalised to {type, org_id, org_name, actor, summary, at}. Filter with `org_id`, `type`, or `q` (substring of summary). Returns newest first.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Platform-wide counts (owner only)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/stats", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "stats" ] }, "description": "Total orgs, pending/active/suspended counts, total users, total calls.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Read per-org throttle limits + current usage (owner)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/orgs/{org_id}/throttle", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "orgs", "{org_id}", "throttle" ] }, "description": "Returns the effective limits (default + org overrides) and the live usage counters for the current minute/hour/day windows for both the `outbound_sms` and `outbound_call` buckets.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Recent digest runs", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/digest/history", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "digest", "history" ], "query": [ { "key": "limit", "value": "", "disabled": true, "description": "" } ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Reject a pending KYC (owner only)", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/orgs/{org_id}/reject", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "orgs", "{org_id}", "reject" ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Remove a recipient", "request": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/digest/recipients/{rid}", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "digest", "recipients", "{rid}" ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Resend the verification email", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/digest/recipients/{rid}/resend-verification", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "digest", "recipients", "{rid}", "resend-verification" ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Reset a user's MFA (owner only)", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/users/{user_id}/reset-mfa", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "users", "{user_id}", "reset-mfa" ] }, "description": "Deletes every trusted device and pending email-OTP challenge for the user. On next login they will be re-challenged with a fresh OTP.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Revoke a developer API key (owner)", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/security/remediate/revoke-api-key/{key_id}", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "security", "remediate", "revoke-api-key", "{key_id}" ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Search & paginate security events", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/security/events", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "security", "events" ], "query": [ { "key": "q", "value": "", "disabled": true, "description": "" }, { "key": "org_id", "value": "", "disabled": true, "description": "" }, { "key": "actor_id", "value": "", "disabled": true, "description": "" }, { "key": "target_id", "value": "", "disabled": true, "description": "" }, { "key": "event_types", "value": "", "disabled": true, "description": "CSV of event_type" }, { "key": "severities", "value": "", "disabled": true, "description": "CSV of severity levels" }, { "key": "outcomes", "value": "", "disabled": true, "description": "CSV of outcomes (success, blocked, denied, flagged, restricted, info)" }, { "key": "since", "value": "", "disabled": true, "description": "" }, { "key": "until", "value": "", "disabled": true, "description": "" }, { "key": "limit", "value": "", "disabled": true, "description": "" }, { "key": "offset", "value": "", "disabled": true, "description": "" } ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Self-heal stale references in one org (owner only)", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/data-integrity/heal/{org_id}", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "data-integrity", "heal", "{org_id}" ] }, "description": "Nulls out stale `contact_id` fields on SMS and call records that point to deleted contacts in the given org. SMS records will then surface as orphans in the tenant's Messages UI; calls will display as 'Unknown' on the call log. Meeting references are NOT auto-healed (deleting an organizer is rare and may indicate the meeting itself should be cancelled). Returns the number of records updated per collection.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Set (or clear) per-org throttle overrides (owner)", "request": { "method": "PUT", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/orgs/{org_id}/throttle", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "orgs", "{org_id}", "throttle" ] }, "description": "Pass a bucket to set its per-org override; omit / null a bucket to fall back to the platform defaults. Use `{minute: 0}` to hard-freeze a bucket.", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } }, "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Set a feature flag (owner only)", "request": { "method": "PUT", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/feature-flags/{name}", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "feature-flags", "{name}" ] }, "description": "Value takes effect immediately \u2014 no redeploy required.", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } }, "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Single digest run with full payload", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/digest/history/{run_id}", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "digest", "history", "{run_id}" ] }, "description": "", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Soft-delete a user (owner only)", "request": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/users/{user_id}", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "users", "{user_id}" ] }, "description": "Marks the user as `deleted: true`. They will no longer be able to log in and won't count against seat quotas, but their history (calls, SMS) is preserved.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Stop impersonating and restore the owner session (owner-or-impersonator only)", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/impersonate/stop", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "impersonate", "stop" ] }, "description": "Reads `owner_resume_token` and swaps the cookies back to the owner. Idempotent.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] } }, "response": [] }, { "name": "Stream a call recording (owner only)", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/api/owner/recordings/{rid}/stream", "host": [ "{{baseUrl}}" ], "path": [ "api", "owner", "recordings", "{rid}", "stream" ] }, "description": "Streams the audio of any recording on the platform through the backend. For real Twilio recordings, the backend fetches with HTTP Basic Auth (account SID + auth token) and pipes the response; for synthetic/demo recordings, returns a JSON 404. Use `