Developers

Build on the same platform
we ship on.

Calls, messages, faxes, recordings, transcripts and contacts through one REST API. Eleven webhook events. One Bearer key per company, generated on your own Integrations page. Included in every seat.

Open the API reference Read the developer guide
Quick start

Your first API call.

one request
curl "https://api.vocatech.com/v1/calls?limit=10" \
     -H "Authorization: Bearer YOUR_API_KEY"
the response, trimmed
{
  "calls": [{
    "call_id": "c045ac31-abbe-45dc-9722-efbe4044cc73",
    "direction": "incoming",
    "status": "answered",
    "remote_name": "Marcus Fletcher",
    "remote_number": "+18585550147",
    "group_number": "+17183951550",
    "start_time": "2026-09-04T14:02:11-04:00",
    "duration": 317,
    "journey": [
      { "type": "auto_attendant", "name": "Main menu",
        "duration": 6 },
      { "type": "call_center", "name": "Support",
        "duration": 22 },
      { "type": "user", "name": "Ellen Price",
        "extension": "104", "duration": 289,
        "summary": "Marcus confirmed the March invoice.
                    Ellen resent a clean copy; payment
                    will be mailed April 30.",
        "transcription": "Hi Ellen, is the March ...",
        "recording_url": ".../v1/media/rec_5d21c0" }
    ]
  }],
  "meta": { "page": 1, "limit": 10,
            "total_pages": 4, "total_calls": 38 }
}

One Bearer token. Paginated list in, JSON back. Every call record carries the caller, the duration and the routing journey, and on recorded calls the recording link, the transcript and the AI summary.

What you can reach

Eight surfaces. Twenty-two operations.

Everything is Bearer-authenticated and scoped to your company. Pagination is page and limit, up to 500 records a page. Dates default to today in Eastern time, with a timezone parameter to override.

Calls

GET /v1/calls

Every call with its full journey: the menu, the queue, who answered, how long each step took, and on recorded calls the transcript and the summary.

Messages

GET, POST /v1/messages

SMS, MMS and WhatsApp history, and sending from your own numbers. A send queue you can inspect and cancel, and a dry-run flag to test first.

Faxes

GET, POST /v1/faxes

Fax history on your virtual fax lines, and sending a PDF from your own software, with the same dry-run flag so nothing goes out by accident.

Media

GET /v1/media/{id}

Message attachments, call recordings as MP3, and fax documents as PDF, through signed links good for 30 minutes, all on the one key.

Contacts

GET, POST, DELETE /v1/contacts

List, create or update, and delete the contacts that put names and record links on Callpop and Reports. Batches of up to 500 at a time.

Webhooks

/v1/webhooks

Create, update, test and delete endpoints, filter by event, extension or number, and list the failed deliveries so you can replay whatever you missed.

Support

POST /v1/support/tickets

Open a ticket with us from your own system. A help desk sync, an automation step, or the AI answering agent posts here and it lands in our inbox.

Identity

GET /v1/whoami

The source address the API sees you as. Handy when a metered messaging key needs your server on its IP allow-list before it will send anything.

The API reads and sends. It does not change call settings such as forwarding or voicemail. Those live in the portal.

Webhooks

Eleven events, pushed as they happen.

Create an endpoint in the portal’s Webhooks panel or through the API, pick the events, and filter by extension or number if you like. Every delivery is signed. Retries run at one minute, five minutes, thirty minutes and two hours, then the delivery is listed under failures for you to replay.

verify.mjs
// Verify X-Vocatech-Signature: t=<unix_ts>,v1=<hex>
import { createHmac, timingSafeEqual } from 'node:crypto';

export function verify(rawBody, header, secret) {
  const parts = Object.fromEntries(
    header.split(',').map((p) => p.split('='))
  );
  const expected = createHmac('sha256', secret)
    .update(`t=${parts.t}.${rawBody}`)
    .digest('hex');
  const ageSeconds = Math.abs(Date.now() / 1000 - Number(parts.t));
  return ageSeconds <= 300 && timingSafeEqual(
    Buffer.from(expected), Buffer.from(parts.v1)
  );
}
Webhook setup guide Webhook test tool
EventFires whenArrives
call.startedA call leg begins within about a minute
call.answeredA call leg is answered within about a minute
call.endedA call leg finishes within about a minute
call.transcriptionThe AI summary and transcript are ready about 5 to 30 minutes after the call
message.sentAn outgoing text or WhatsApp message is sent within about a minute
message.receivedAn inbound text or WhatsApp message arrives real time
message.status_updatedA delivery status changes within about a minute
fax.sentAn outgoing fax is queued within about a minute
fax.receivedAn inbound fax arrives within about a minute
fax.deliveredAn outgoing fax is confirmed delivered within about a minute
fax.failedA fax transmission failed within about a minute
Production-ready

Auth, rate limits, and webhooks done right.

One key per company
Generated on your own Integrations page in the portal, scoped to your company’s data. No OAuth dance. A messaging-only key for volume.
Signed webhooks
HMAC-SHA256 over the timestamp and the raw body, in the X-Vocatech-Signature header. Reject anything older than five minutes.
Rate limits that fit real work
600 requests a minute by default and 100,000 a day, per key. A 429 tells you when to retry, with a Retry-After header on it, every time.
Runs where we run
Vocatech’s own application layer on Google Cloud, US regions. Recordings and fax documents come back as signed links good for 30 minutes.
Rate limit, per keyPer minutePer hourPer day
Default, most endpoints6003,600100,000
Reports (GET /calls, GET /messages)3003,000100,000
Messaging (POST /messages, general key)20200
API Messaging key (metered, $0.02 a message)605,000

The general key includes 20 texts a minute and 200 a day. For volume, a metered API Messaging key is switched on per company in the portal under Textdock, with its own limits and per-message billing.

Also on the same key

For AI assistants, and for your help desk.

An MCP server for AI assistants

Point an MCP-capable assistant at Vocatech with your API key and ask about your calls in plain English. It reads the same calls, journeys, summaries, transcripts and messages the API returns. It never gets the audio.

Set up MCP

Support tickets from your own system

POST /v1/support/tickets opens a ticket with us from a help desk sync, an automation step, or the AI answering agent’s after-message action. Your own reference keeps follow-ups on the same ticket for seven days, and the reply reaches whoever you name.

Read the guide

Start building.

The Swagger reference with real auth and try-it, and a long-form guide with concepts, payloads and curl examples. Generate a key on your Integrations page and go.

API reference Developer guide