Build Carrier-Grade Voice & CRM With Elegant APIs
Programmatically trigger outbound calls, stream dialer campaigns, sync customer dossiers, and subscribe to real-time telephony webhooks with OpenAPI 3.1 precision.
Initiate a softphone phone call. Bridges the destination phone number and connects the active Asterisk audio stream to the agent extension.
{
"to": "+919820112345",
"agent_id": "usr_aarav_sharma",
"caller_id": "+918049200000",
"record_audio": true,
"lead_id": "led_98412",
"campaign_id": "cmp_77192"
}{
"call_id": "call_89f02a9e",
"status": "ringing",
"to": "+919820112345",
"agent_id": "usr_aarav_sharma",
"direction": "outbound",
"recording_enabled": true,
"created_at": "2026-10-29T14:15:22Z"
}Programmatic Control Over Your Entire Platform
Fully documented REST endpoints for voice calls, lead queues, contact dossiers, campaigns, and supervisor presence.
Initiate an outbound WebRTC or PSTN phone call and bridge to an active agent softphone.
Query, filter, and paginate through inbound leads with score, source, and ownership parameters.
Create or atomically upsert a customer 360 contact with custom attributes and company link.
Stream and enroll batches of prospect phone numbers into an active predictive or power dialer campaign.
Poll real-time presence states (Available, On Call, ACW, Offline) across your contact center roster.
Real-Time HMAC-Signed Webhook Feeds
Subscribe your microservices, ERP, or serverless functions to real-time events with guaranteed at-least-once delivery.
Fired when a new lead is ingested from web form, Meta ads, or Google ads.
Fired when lead score changes or rep status advances.
Fired when an inbound ring starts or an agent triggers click-to-call.
Fired when the remote party picks up and audio bridge connects.
Fired upon disconnect, delivering duration, disposition, and audio recording URL.
Fired when a contact record is generated or converted from a qualified lead.
Fired when an outbound dialer campaign transitions to active pacing.
Developer & API Questions
Answers regarding authentication headers, rate limits, SDK availability, and webhook signatures.
How does API authentication work?
All API requests require Bearer token authentication via API keys passed in the Authorization header (`Authorization: Bearer sk_live_...`). Enterprise accounts can generate scoped API keys with fine-grained read/write permissions per resource.
How are webhook payloads secured against tampering?
Every webhook sent by Callflow includes a cryptographic HMAC-SHA256 signature header (`X-Callflow-Signature`). You can verify that the payload originated from Callflow using your shared webhook secret.
What are the default API rate limits?
Standard accounts are provisioned with 100 requests per second (RPS) with burst allowance up to 250 RPS. Enterprise accounts feature dedicated isolated API gateways with custom rate limits up to 2,000+ RPS.
Which official client SDKs are available?
We maintain official, type-safe SDKs for TypeScript / Node.js, Python, Go, Java, and PHP, complete with auto-generated OpenAPI 3.1 specifications and Postman collections.
Start Building with Callflow APIs Today
Access complete interactive documentation, SDK quickstarts, and test keys in seconds.