Telenaas API

In-app audio calls this key can see, most recent first.

Rings another account over WebRTC. No number is dialled and no carrier is involved, so there is no per-minute charge; pass `to_user_id`. For a call to a telephone, use TeleVoip instead.

Meetings for this tenant, most recent first.

Room size is capped by the tenant's plan. Asking for more is refused rather than quietly reduced.

One meeting, with its join code and dial-in PIN.

Marks it cancelled. Anyone already in the room is not thrown out.

Closes the room. The recording, if there was one, still has to be claimed.

Opens the room and tells everybody watching the directory that it has started.

One demo, with its audience count.

Scheduled, live and finished product demonstrations.

Creates the demo and its public page. Viewers join by slug and need no account; a demo is a broadcast with a question queue, not a meeting everybody talks in.

People who asked for a demonstration and have not had one yet.

The audience's questions, most upvoted first, with the answers given.

Give a number to a person in this tenant, or to a TeleAssistant so that it answers instead.

Telephone call history for this tenant.

An emergency number takes a different path: never billed, never rate-limited, and refused outright if there is no dispatchable location.

Numbers this tenant holds.

A short-lived download link for a file message: the provider's own when it can sign one, ours otherwise.

The website widgets this tenant has, with their public keys and allowed origins.

Returns a public key for the `<script>` tag. The key is not a secret — `allowed_origins` is what keeps the widget to your own sites, and an empty list refuses every origin.

`name`, plus a `phone` or an `email`. The card is encrypted whole in the message body rather than spread across metadata, because it is somebody's number.

Days moved out of the hot window into the organisation's storage, newest first.

Chat threads this key can see, including those started from a website widget.

Multipart `file`, or JSON `name` and base64 `data`. Stored in the organisation's own storage; the message carries only the name and a reference.

Between the calling person and `user_id`; reuses the existing one.

The hot window, newest last, decrypted for the caller. Older days are in the archive.

Posts into a conversation. Bodies are encrypted at rest per tenant.

A recording, with `seconds` from whatever recorded it. Audio only: anything else is refused rather than stored as something no client can play.

The messages of one archived day, fetched from the organisation's storage and decrypted for the caller.

Allowed content types and extensions, the size ceiling per class, and how long a voice message may run. Published so an integration can refuse a file before uploading it.

Pass `audience=public` to get only articles that may be sent to a customer.

With its messages. Internal notes are included only for a key holding helpdesk:respond.

Set `internal` to true for a note to colleagues, which is not sent to the requester.

Help desk tickets for this tenant.

Routed to a queue by the same rules a ticket opened by a person would be.

The assistants in this tenant and the numbers they answer.

A greeting, business hours, and what to do outside them: take a message, offer a menu, forward, or hand over to an AI agent.

Who called, when, and the transcript. The audio is not here: like every recording, it is delivered to a device or to Burmeel Storage and never kept in our database.

One assistant, with its menu and its schedule.

Marketing campaigns and their state.

A message and an audience. Marketing insists on opt-in and obeys quiet hours unless you say otherwise; `{{name}}` and anything else you stored about a person is filled in per message, and a message with a gap nothing fills is not sent to that person.

The audience is fixed at this moment; people added later are not caught up in it.

Stops it for good.

Sent, delivered, failed, skipped, replied.

What has gone has gone; what has not, will not until it is sent again.

Per person: what happened, and if they were skipped, why.

Numbers averaged, choices counted, free text left alone — an average of somebody's sentences is not a finding.

Per person: where they got to, and what they said.

The questionnaires this tenant has written.

Questions are asked one message at a time. A question may be `scale` (a number in range), `yes_no`, `choice` (answered by word or by position) or `text`.

Asks the first question of everybody on the audience; the rest follow as they answer.

What has been raised.

Sent at any hour — an alert is the one thing that ignores quiet hours. With `ack_required`, a reply is recorded as an acknowledgement and you can see who has answered.

Including who acknowledged it.

And who has replied to say they are on it.

What we are tracking, and its state.

Keyed on your own reference, so sending the same order twice updates it rather than duplicating it. The customer is told only when the status actually changes, and only where a rule says to.

What gets said when an order reaches a state.

One message per status. `channel` may be `sms` or `whatsapp`; a WhatsApp rule needs an approved template, and `fallback_channel` says what to do when WhatsApp cannot carry it — without one, nothing is sent rather than quietly switching channel.

Including the history of what it has been.

What is in flight.

The same shape as an order: your reference, the customer, the status, and anything else — a tracking link, an ETA — which the message can refer to by name.

What gets said at each stage.

By text or WhatsApp, with a fallback when WhatsApp cannot carry it.

And its history.

And its history.

Confirmations, reminders and cancellations.

A negative `delay_minutes` is a reminder: -1440 is the day before. A reminder re-reads the booking before it goes, so one cancelled in the meantime is not reminded about.

Appointments and their state.

`at` is when the appointment is. A customer who replies YES confirms it and one who replies NO cancels it, which you read back here as a status rather than as a message to interpret.

Every stop, by the code riders text.

Keyed on the code printed at the stop. Bad rows are named and the rest are written — a timetable from somebody else's system should not fail whole because of one stop.

The numbers and keywords this operator answers on.

Bind a service to one of your numbers, optionally behind a keyword so one number can run several: "BUS 4412" and "TRAIN 4412".

The next departures from one stop, as a rider texting it would be told.

Keyed on stop, line and timetabled time, so pushing the same board every thirty seconds updates it rather than duplicating it. `expected_at` is what you now believe, and is what riders are told.

What we can answer about.

Keyed on number and date, because BA123 is a different aeroplane every morning. Send the whole board as often as you like.

Where TeleFly answers.

Bind TeleFly to a number.

Where TeleCrime answers.

`config.anonymous` makes it anonymous, in which case the reporter's number is never written down. `config.emergency_number` is the number every reply tells people to ring if they are in danger.

Behind its own permission: setting up a line and reading what was confided to it are different things.

Including what was written.

received, acknowledged, investigating, closed.

Status only — never the code, which we do not keep.

Six digits to a telephone number, hashed here the way a password is and never stored in the clear. Defaults: ten minutes, five attempts. `message` may carry your own wording with `{{code}}` in it; `reference` is your own identifier for whatever you are protecting, handed back to you. Asking again for the same number cancels the previous code.

Its state and how long is left of it.

Sent, approved, expired and failed over the last week, with the success rate. Watch the expired count: codes sent and never checked are people who never received them.

Answers 200 with `approved` or `denied` and a reason — a wrong code is an answer, not a failed request. A code works once; an approved verification cannot be approved again.

The same check against whatever is outstanding for a telephone number, for callers who know the number rather than our id.

Including what the device reported.

Sensors, doors and panels, and which have gone quiet.

Keyed on your own reference. `heartbeat_minutes` is how often it promises to report; silence past twice that is itself an alarm, because a cut sensor cannot announce that it has been cut.

The ones to go and look at.

Raised, notified, acknowledged, resolved — or expired, which means nobody ever answered.

The call a panel makes at two in the morning, so it is the simplest one here. A repeat of something already ringing updates it rather than raising a second alarm and waking the rota twice.

With a note about what it was.

In the order they are told.

`step` is the escalation order: everybody on step one is told at once, step two only if nobody answered within five minutes.

And what became of each.

A fall, a missed dose, a reading out of range. Anything in `reading` is encrypted at rest and is never put in a message to family.

With a note.

A monitor that has stopped reporting is not a monitor.

Health devices and which have gone quiet.

The same shape as TeleGuard: your reference, what it is, where it is.

With their role, which decides what they may be told.

`role` matters here: a clinician may be told the reading, family are told that something happened, where, and who to ring. That line is not a template setting.

With the reading, for somebody allowed to see it.

What agents are running, and what they have spent.

Give the agent one person to talk to, the channels it may use, the actions it may take and what it may spend. An agent with no `allowed_actions` can only listen.

`send_message`, `place_call`, `open_room` or `hand_over`. Checked in that order: may it, can it afford it, is the destination allowed — the same dial policy a person is held to.

Its leash and what is left of the budget.

Nothing further may be done on it.

Including what it tried and was refused, with the reason — "it never rang them" and "it tried and was not allowed to" are different facts.

What this account may buy, which is not the whole shop: a household is not offered the 24-zone panel and a business is not offered the single-flat starter kit. `works_with` names the products an item talks to; `requires` names what must already be on a bundle before it can be added to one. A `stock` of `null` means made to order rather than sold out.

Including the delivery address, which is encrypted at rest.

Newest first, with their lines.

`items` is a list of `{sku, quantity}`. Nothing else is read from it — a price sent in the request is ignored, and every line is priced from the catalogue inside the same transaction that takes it out of stock. One line that cannot be sold refuses the whole basket, because a hub without its sensors is an alarm that cannot ring.

What the bundle came with cannot be taken off it — cancel or change the bundle instead.

With what each one needs.

An accessory is refused unless the bundle already includes what it needs; an upgrade requires nothing, because buying it is what adds the product.

What is on it, what it costs a month, and — if there is none — which bundle this account could take.

The row stays, with the date. The charging stops.

Refused for a company account: TeleHome is a household and TeleBusiness is premises, and selling either to the other is selling the wrong shape of thing.

As TeleHome, for a company.

The charging stops.

Refused for a personal account, for the same reason in reverse.

From next month.

Seats, sites, campaigns, storage and numbers.

Charged from the month it is added.

Newest first, filterable by account, kind and status.

The call to make the moment money moves. `reference` is your own and is the idempotency key: post the same movement again — after a timeout, say — and you get 200 with `duplicate: true` and the holder is not texted a second time. Amounts are positive integers in minor units; which way the money went follows from `kind`, so a negative amount is refused rather than read as a direction.

Newest first, filterable by your `reference`. How each call ended, never what was typed.

`in_reply_to` is the id of a text the customer sent in the last 15 minutes, and `reference` your own name for what is being approved. We ring the sender from the number they texted and ask for their PIN on the keypad. The digits are posted once, signed like any webhook, to your endpoint subscribed to `telecash.pin.entered`; answer `{"result": "approved" | "retry" | "refused"}` and the caller hears it. **The digits are never stored, logged or retried** — there is no delivery record of them to replay. How the call ended arrives as `telecash.pin_call.ended`. Three calls per number per 15 minutes; your dial policy applies.

`text` (up to 480 characters) goes to the number that sent the message, from the number it was sent to. Only within 30 minutes of it arriving and at most five times per message: a TeleCash key answers people who wrote to you, it cannot text anybody else.

As you last reported it.

Its status: ringing, answered, approved, refused, unavailable, not_answered, abandoned or timed_out.

The accounts you have registered, with the balance you last reported and when you reported it.

Keyed on your own reference. `holder` is the telephone that gets the alert, and it is also how the account holder's own Telenaas app finds this account. A `balance_minor` here is recorded as reported now — we never compute one, because a balance worked out from messages we might have missed is how somebody is told they have money they have not got.

The words of an inbound text, by the `message_id` in an `sms.received` webhook. The webhook names the message and never carries its words, because deliveries are stored and replayable while message bodies are kept encrypted. Readable for 30 minutes after it arrived; older texts are the console's business.

What moved in the last day, and how many alerts have not gone out.

Including the counterparty, which is encrypted at rest.

With its history.

What is booked, and where each one is up to.

Keyed on your own reference. `at` is the arrival — a rule with a negative delay counts back from it, so the evening before is the evening before the guest arrives rather than the evening before they booked.

What is said at each state of a stay.

One message per status, per channel.

Issued, due, paid, overdue.

`at` is when it falls due, which is what the reminder counts back from. Marking it paid stops the chasing: rules fire on a change of status, and paid is a status.

With its history.

What is said at each state of a bill.

Including the reminder before the due date and the chase after it.

What is said at each state.

Including the one that chases a late invoice.

With its history.

Sent, viewed, due, paid, late.

Put the payment link in `attributes` and name it in the rule's body — the message that gets paid is the one somebody can pay from.

When to remind, and what to say.

A negative `delay_minutes` counts back from `at`; a positive one follows up after.

What is waiting to be sent.

`at` is when the thing happens — the exam, the interview, the train, the payment. A rule with `delay_minutes: -1440` sends the day before. A reminder whose moment has already passed is not sent, because a reminder about something that has happened is noise.

With its history.

What is said at each condition.

One message per condition, per channel.

`condition` is one of steady, movement, high_demand, shortage, disruption, recession, recovery. Everybody watching that market is told, under their own rules and their own quiet hours. **A signal repeating the condition somebody was last told is not sent to them** — an alerting product that cries the same thing twice teaches people to ignore it — and the answer says how many were told and how many were already there.

Everything anybody here is watching.

One row per person per market, with the condition each was last told about.

`market` is the thing — an instrument, a commodity, a supply line — and `customer` is the telephone that hears about it. Idempotent per person per market, so a client retrying a sign-up does not create two.

Speeds, caps, contract length and what we pay for it — a key belonging to the reselling organisation may see the wholesale price and the margin, because they are the reseller.

Address in, availability out. Three answers: available, not available, or `available: null` — which means that partner publishes no qualification API and a person has to check. The third is not a failure and the plan stays orderable.

`market` is required: a plan list without one is a list of things that may be impossible where the customer lives. Fibre, DSL, cable, fixed wireless and satellite, cheapest first, with the partner behind each one named.

Their word for the state is recorded as it came. Only unambiguous ones move our status: `completed` means live, `rejected` means failed, and anything else leaves ours alone rather than guessing.

`status` is ours, `partner_status` is theirs. A partner with no integration answers `awaiting_manual_submission`, which means **nothing has been sent yet** and a person must place it. Treating that as success is how a customer is told their line is ordered when it is not.

Every state change and every message from the partner, in order — because a line that took three weeks is a story somebody has to tell a customer.

The provider is asked first where they allow it, then the order is marked cancelled. A cancellation recorded but never received is a service that keeps being billed.

This organisation's orders for broadband, newest first.

Needs the installation address. Refused when there is no signed agreement with the partner, when the agreement does not cover that country, or when the address came back unavailable. The price is taken from the catalogue and frozen onto the order; a price in the request is ignored.

Brand, model, storage, data allowance and validity, as the supplier stated them.

As with every product here: `awaiting_manual_submission` means a person still has to place it with the distributor.

This organisation's orders, newest first.

A device order may carry an `imei`, which is checked against the Luhn rule before it is believed. An eSIM order carries the phone's `eid` where the supplier issues profiles to a named device. Stock is decremented inside the order, so two people cannot buy the last handset.

Their status, recorded as they said it.

`market` is required. `kind` narrows it to `handset`, `router`, `sim`, `esim` or `mobile_plan`. Stock is reported as `in_stock` rather than a count, because a count that is one behind is worse than a boolean.

Every state change, in order.

Asked of the supplier, then recorded.

Their status, recorded as they said it.

This organisation's orders, newest first.

Needs the watching country. Checked twice: against the partner's programme and against the package's own rights territories, because a partner can operate in a country where a particular package is not licensed.

`market` is required and means the country the customer watches in. Television rights are granted per country, per channel and per window, so a package sellable in Ireland may not be sellable in France even from the same operator.

The channel line-up exactly as the operator published it, the rights `territories`, and whether rebranding is permitted. An empty channel list means they published none — not that the package is empty.

`awaiting_manual_submission` means nothing has been sent yet.

Every state change, in order.

Asked of the operator, then recorded.

Its own status and its own flag, because it is the number a centre is judged on and folding it into "ended" is how it disappears from a report.

`center:work`, not `center:manage`: going on a break should not need a supervisor. `away` needs a reason. Refused while on a call, because the router would otherwise offer a second one.

Three distinct refusals: no such queue, nothing waiting, or nobody available — and a supervisor needs to know which.

The agent goes into wrap-up for as long as the queue promised. Talk time is metered here — a call nobody answered cost nothing to carry.

Per queue: waiting, longest wait, agents by state, handled and abandoned today, and the service level measured from the last day's calls. `service_level` is **null** when nothing has been answered — not 100.

Waiting, ringing and talking, oldest first, with live wait times.

Answers with the assignment, already offered to somebody if anybody was free. The caller is queued the moment they arrive whether or not there is an agent.

Its own step on purpose. Collapsing it into the end of the call is the change that quietly removes wrap-up from the product.

With what each is doing and for how long. `available` is the only state a call is offered to: wrap-up is not available, and neither is a break.

Queues, skills, and whether they may supervise. Supervising is a capability on the agent rather than a role, so promoting somebody to administrator does not silently let them listen to calls.

Each with its strategy, its wrap-up seconds and its service-level promise as words.

`strategy` is one of `longest_idle`, `round_robin`, `fewest_calls` or `skills` — named rules rather than a score, so a supervisor can predict who the next call goes to. A skills queue with no skills is refused, because that is a longest-idle queue wearing a confusing name.

The wait is measured here and stamped against the queue's own promise, once. Nothing recomputes a service level later from averages.

Meters two things, because they are two costs: `stream.ingest.minutes` is what the transcoder ran for whether or not anybody watched, and `stream.viewer.kminutes` is what the edge served, in thousands of viewer-minutes. Pass `received_video: false` to end it as `failed`.

Refused with `already_live` when the channel already has one live — by a database index, not by a check two requests can both pass. Two ingests on one playback URL is what happens the first time an encoder reconnects early.

Each with its playback URLs, its latency mode and the last four characters of its ingest key. The key itself is not here and never will be.

Creating one answers with the ingest key — **the only time it is returned**, because it is stored hashed. `handle` is in the playback URL and is unique across the platform. `latency_mode: "low"` costs more to serve and is what an auction or a live shop needs; `standard` is what a lecture needs.

With both measured durations and both viewer figures — now and the peak. A falling "watching now" means nothing without the peak beside it.

For when a moderator was wrong.

Hides; nothing deletes. The row keeps who hid it and why, so the author can be told and the moderator can be asked. Silently dropping a muted viewer's messages while still showing them their own is the most common dark pattern in live chat, and there is no endpoint for it here.

Answers with the new key and invalidates the old one immediately. A rotation that leaves the old key working is not a rotation.

Without putting anything else up.

In the order the seller put them in, with whichever is pinned flagged.

`price_cents` and `currency` are required. Live commerce runs on urgency, and urgency with the price hidden until checkout is a trap rather than a feature. Refused with `commerce_not_enabled` when the channel has no shop switched on.

One at a time, in one transaction, so there is no moment where the stream is showing two prices.

The samples, so a chart can show whether people arrived and stayed or arrived and left. A peak alone cannot tell you which.

Reported by whoever is counting at the edge; the peak is stamped here as it is passed. Nothing estimates this number, because it is the one capacity is bought against.

Hidden lines are left out unless `moderator=true`, which needs `stream:moderate`.

Needs only `stream:read`: a viewer is the point of a chat. Slow mode is enforced per author — a viewer with two tabs is one author — and a refusal says how many seconds are left rather than dropping the message.

Ingest seconds and viewer seconds are reported separately because they are billed separately, and an invoice should be checkable against this.

Filter with `status` (`scheduled`, `live`, `ended`, `failed`) and `channel_id`. `failed` means it went live and no video ever arrived — distinct from `ended`, because "nobody watched" and "it was never on" call for opposite responses.

`record` is decided here, while nobody is watching, and is refused afterwards. A recording switch that can be flipped mid-stream records people who were told it was off.

Each product has its own: what it is for, what it can do, what it refuses, and the questions worth asking it first. Only products on this plan are listed.

Infrastructure token. What the assistant in front of this number wants done with an incoming call: the greeting, the action, the forward or the menu. 404 with `no_assistant` means ring it normally.

`question`, and `context` for what the caller already has on the screen. It answers and suggests; it never acts. Charged as one assistant message, half price on your own provider key, and every answer says a model wrote it.

The lists this tenant writes to, and how many people are on each.

A named list to send to.

Everybody on a list, with whatever the business knows about them.

Takes as many as you send, and answers with how many were added and which were rejected and why. A number that is not a number is named rather than failing the upload.

They stop being written to by anything that uses this list.

Hash-chained, append-only, and readable here.

Infrastructure token. `started`, `answered` or `ended`, keyed on the switch's own call id. This is what turns a call into a record with a duration and a cost.

Where an emergency call from this number goes, and with what address.

Greetings for TeleCall, TeleVoip and TeleMeet: the caller's own and the organisation's shared one. `product` narrows it.

Multipart `file`, or `name` and base64 `data`, plus `product`. Audio only, two minutes at most, and charged for nothing — it is somebody's own voice.

`script` and `product`, optionally a `voice`. Charged per thousand characters of speech, half price on your own provider key. Nothing is stored if the engine cannot speak: a greeting that plays silence is worse than none.

The audio is deleted from storage as well as the greeting retired. The audit trail keeps the record that it existed.

One default per person per product, enforced by a database index rather than by hope. The previous default is cleared in the same transaction.

Used by the telephony switch. Authenticated with the infrastructure token, not an API key.

Used by the conference bridge. Admits a caller and answers with the RTP addresses for their leg, or 202 when the host has not admitted them yet.

Releases the media node's ports when the caller hangs up.

Filterable by `market`, `domain`, `model` and `white_label=true` — the last being the shortlist of programmes documented as allowing our own brand on their service. `resale_permitted`, `markup_permitted` and `has_api` are separate fields on purpose: **API access is not resale authorisation**, and a provider with an excellent API whose terms forbid a markup is a supplier of capacity rather than a product.

What was actually signed, which is frequently not what the programme advertised. Credentials are never returned.

With how many programmes are in each — the honest answer to "where could we launch", since a country with one agent and no API is not a country we can launch in.

Orders, revenue and margin per product, computed from the orders rather than from the catalogue — the catalogue has changed since and the orders are what happened.

Capabilities per function, the access tier as plain words, published commission terms where a company publishes them — and `null` where nobody does, rather than a plausible number somebody would quote back as fact.

The product line, what each one is for, which tiers it has, and which of them this tenant's plan actually includes. Read this rather than hard-coding the list.

STUN, plus a TURN credential minted for this request and valid for an hour. Fetch these per session rather than caching them: WebRTC that works in an office and fails on a phone is almost always a missing relay, and a stale credential fails the same way.

Opens the room for one of this tenant's meetings on the media plane and returns the router's RTP capabilities — the first step of the mediasoup handshake. `room` is the meeting id; a meeting belonging to another tenant answers 404 exactly as a made-up id does. Signalling continues over the media socket. If no media plane is configured this answers 200 with `sfu: false`, so a caller can fall back to mesh instead of waiting.

Participant rows for one of this tenant's rooms — peer id, name, role, admitted or waiting — with what each is publishing on the SFU and whether it is paused. The roster a host control is aimed from.

Releases their SFU peer at once, so their media stops before their browser is told, then closes their signalling channel. A grant socket token opens one socket, so the removed person cannot reconnect on the token they had.

`kind` is `audio` (default) or `video`; `muted` defaults to true. Pauses their producer on the SFU and holds the mute in their channel, so opening a fresh producer of that kind is refused until a host unmutes them.

Closes the recording; hand it over with the recordings API.

Server-side recording. Refused with the reason unless the tenant enabled it, the plan includes it and the meeting was created with `record_server_side`.

A two-minute token that opens the signalling socket at /media/socket in place of the API key, so the key never appears in a WebSocket URL, a proxy log or a browser history. Pass it as the `token` connect parameter. Send `room` (and optionally `name`, `role` = participant | viewer, `publish` = [audio, video]) to mint a grant: one room, one vouched-for name, only the listed media, one socket.

The accounts connected for sending. Credentials are never returned.

`provider` and the fields that channel asks for. Refused when the details are not enough to send with, rather than stored and discovered useless at the moment somebody shares something. The token is encrypted under the tenant's own credential key.

The row goes and the token with it. Not disabled: a credential we were asked to stop holding is not kept in case somebody comes back.

WhatsApp, email, Telegram, Facebook, Instagram — each with the fields it needs and what it can and cannot carry. Instagram takes pictures only; a page post cannot carry a voice message.

`provider`, and `destination` where the channel addresses somebody. Words, a picture, a file, a voice message or a contact. Recorded whether it worked or not — and once it has gone, it has gone.

What this key can reach, and whether the platform is healthy.

The organisation's storage plane: Burmeel by default, or its own Amazon S3, Google Cloud Storage, Azure Blob or S3-compatible bucket. Never returns credentials.

`provider` (burmeel, s3, gcs, azure), `bucket`, `endpoint`, `region`, `account`, `prefix`, `key_id`, `secret`. Credentials are encrypted under the organisation's own key and only replaced when supplied.

Writes, reads back and deletes a probe object with the configured credentials.

Metered usage for the current billing period.

Where we send events.

Returns the signing secret once. The timestamp is inside the signature, so a captured delivery cannot be replayed later.

So "it never arrived" has an answer.

Every run, with the steps it took and the ones it was denied.

What runs on its own in this tenant.

A JSON-RPC dispatcher for agents. Tools are named for the product they belong to; each enforces its own permission, so an agent can never reach further than a REST client holding the same key.