Runtime v1
API contract
The live contract for communication actions initiated by an authorized agent runtime.
Available now
Agent actions
| Action | Endpoint | Request | Response |
|---|---|---|---|
Create call active | POST /api/telephony/runtime/v1/calls | agentId, to, authorizationContext | 201 with the accepted call and allocated line |
Send text message active | POST /api/telephony/runtime/v1/messages | agentId, to, body, consentBasis, confirmed, idempotencyKey, authorizationContext | 201 with the accepted message |
Send image message active | POST /api/telephony/runtime/v1/mms | message fields plus filename, mimeType, bytes, sha256 and dataBase64 | 201 with the accepted image message |
Required headers
Runtime authentication
- Service identity
- Authorization: Bearer <server-managed token>
- Approved invocation
- x-emenes-runtime-assertion: <signed assertion>
- Content
- Content-Type: application/json
The service token and signing secret remain on trusted servers. Browser clients do not receive either credential.
Approval binding
Authorization context
- approvalId
- approvedByUserId
- approvedAt
- tenantId
- workspaceId
- roomId
- runId
- invocationId
The signed assertion is bound to the tenant, approval and invocation. Reusing it for a different request is rejected.
Retired prototypes
Legacy routes
The old /api/v1/* and /api/compat/* browser simulation routes return HTTP 410 and never create communication activity.