Public, rate-limited integration endpoints are available for WebRTC signaling, contact forms, captcha and the OIDC discovery / token / activation flows. Administrative and platform APIs — /api.ashx for outbound AI calls, transcripts, routing, webhooks — require an admin OIDC Bearer or a scoped ak_-prefixed API key minted from the admin UI. All endpoints are CSRF-resistant, HMAC-signed where appropriate, and rate-limited at the host.
/<name>.ashx on the tenant’s base URL (e.g. https://phone.aloaha.com/signal.ashx). All endpoints honour the tenant by inspecting the request Host: header — no API key needed.Every public endpoint in one machine-readable file: /openapi.json (also /.well-known/openapi.json). Import it into your API client or code generator; each operation says who may call it (x-codeb-audience: public, wallet, signed-in, admin, operator).
Platform REST API v1 — outbound AI calls, virtual numbers, transcripts, inbound + outbound routing, webhook subscriptions. JSON in and out, every endpoint a single curl example. Auth via OIDC bearer or ak_ API key.
WebRTC signaling WebSocket + public health + camera list + bridge ring-push endpoints.
Read the API doc →Local team chat — DMs, group channels, file transfers up to 20 MB, WebSocket live push at /chat-ws.ashx. Per-tenant, OIDC-authenticated, no third-party gateway. REST for send/list/mark-read/delete, WebSocket for real-time delivery.
Per-tenant outbound-PSTN whitelist. GET the list, POST a single number (idempotent — CRM-friendly), or replace the entire list. Hot-reloads in the bridge with no restart.
Built-in OpenID Connect IdP — discovery, JWKS, authorize, token, end-session, revoke.
Read the API doc →OID4VP 1.0 verifier endpoints — vp-start, vp-request, vp-response, verifier-metadata, SSO assertion. Both Client Identifier Prefixes — x509_hash (mandated by HAIP 1.0 Final) and x509_san_dns (additional OpenID4VP compatibility mode; not HAIP 1.0 Final). Caller picks per request.
CSC v2 remote-signature subset — info, auth/login, credentials/list, credentials/info, credentials/authorize (SCAL1/SCAL2), signatures/signHash, signatures/signDoc (§11.10), signatures/timestamp (RFC 3161). Per-user EC P-256 signing cert enriched from the OIDC profile. Powers the browser-based Web Wallet PDF signer and server-side PAdES-B-T flows, and is ready for European Digital Identity Wallet integrations.
The API behind sign-request.html: upload PDFs, sign with CodeB Wallet by QR code, invite people by e-mail to sign one after another, see whether each invitation e-mail went out and send it again. Wallet side designed to follow ETSI TS 119 432; not certified.
Read the signing requests API doc →Read the chip of a passport or ID card through CodeB Wallet with the server as the terminal (PACE, chip and passive authentication), invitations, account check, and guest accounts the app opens itself after an e-mail code. Document check only; designed to follow ETSI TS 119 461; not certified.
Read the passport & ID card API doc →Drop a contact-form message into the IIS SMTP pickup directory. Captcha-gated.
Read the API doc →Create a new (disabled) user; activation email follows. Captcha-gated, HA1-only.
Read the API doc →Consume the one-time activation token sent by signup. Flips the disabled flag.
Read the API doc →Stateless math captcha used by contact + signup. HMAC-signed, no cookies.
Read the API doc →Client-side WebRTC diagnostic log append. POST is public; GET is admin-gated.
Read the API doc →Per-tenant /robots.txt and /sitemap.xml generated from filesystem scan; RFC 9116 /.well-known/security.txt for coordinated disclosure. [NEW 2026-06-13]