Enterprise Call Auditing API: Endpoints and Examples
v1 call auditing API reference: organization key authentication, creating audits by URL or upload, agents, teams, scripts, analytics, HMAC webhooks.
Practical reference for the v1 call auditing API — the integration channel between the call auditing module and your PBX or telephony platform. Requires an organization with an enterprise plan and an organization API key.
Authentication
Create the key at /dashboard/organization/auditorias (OWNER/ADMIN; up to 10 active keys per organization) and send it with every request:
Authorization: Bearer vpt_live_SUA_CHAVE_DA_ORG
- The secret is shown only once at creation — we store only the hash.
- Each key carries scopes (
audits:write,audits:read,usage:read,analytics:read, among others); anything not granted is denied by default. - Rate limit: 60 requests/minute per key.
Creating an audit
curl -X POST https://www.vozparatexto.com.br/api/v1/audits \
-H "Authorization: Bearer vpt_live_SUA_CHAVE_DA_ORG" \
-H "Content-Type: application/json" \
-d '{
"audio_url": "https://pbx.suaempresa.com/gravacoes/8841.mp3",
"webhook_url": "https://api.suaempresa.com/hooks/auditorias",
"idempotency_key": "chamada-8841",
"agent_external_id": "maria.souza",
"team": "vendas-sp"
}'
Rules:
- Accepts
audio_url(onlyhttps, public) orupload_id(see below). webhook_urlis required — the result arrives via webhook, not by polling.idempotency_keyis durably persisted: resending with the same key does not create a duplicate audit.- Immediate response:
202 { "audit_id": "...", "status": "queued" }.
Queries: GET /api/v1/audits (list) and GET /api/v1/audits/{id} (details).
Recordings without a public URL
For PBX systems that don't expose a URL, request a temporary upload URL:
curl -X POST https://www.vozparatexto.com.br/api/v1/uploads \
-H "Authorization: Bearer vpt_live_SUA_CHAVE_DA_ORG"
The response includes a put_url valid for 1 hour: upload the file with a PUT and use the returned upload_id when creating the audit.
Operations setup and metrics
| Endpoint | Purpose |
|---|---|
GET/POST /api/v1/agents | Agents (with external identifier from your system) |
GET/POST /api/v1/teams | Teams |
GET/POST /api/v1/scripts + POST /api/v1/scripts/{id}/versions | Scripts and versions |
GET /api/v1/usage | Period usage |
GET /api/v1/analytics/summary | Analytical summary of the operation |
GET /api/v1/analytics/agents/{external_id} | Metrics per agent |
Webhooks and guarantees
- Deliveries signed with HMAC-SHA256 (
X-VPT-Signature+X-VPT-Event); validate before processing. - 15 s timeout per attempt, up to 6 attempts with backoff from 5 min to 24 h.
- Stuck jobs don't disappear: a queue stopped for >10 min is re-enqueued; processing stuck for >60 min becomes a failure with an error webhook. Every submitted audio generates a final callback.
More details in Webhooks and notifications.
FAQ
Can I use my personal API key here?
No — the call auditing API uses organization keys, created by OWNER/ADMIN in the auditing dashboard, with their own scopes.
I sent the same call twice. Will it duplicate?
No, if you used the same idempotency_key — idempotency is durable in the database.
The put_url expired before the upload finished. What now?
Request a new put_url (valid for 1 hour) and redo the upload; nothing has been created yet.
How do I restrict what each integration can do?
Create separate keys per system, each with only the necessary scopes (e.g., the internal dashboard with only analytics:read), and revoke individually when needed.
Related articles
Still stuck? Open a ticket — our team responds quickly.