Developers
Build on what we ship on.
One REST API for calls, recordings, transcripts, texts, faxes and contacts, with a signed webhook for each event. You make the keys yourself in the portal, and the API comes with every seat. It reads and sends, and it never changes your call settings.
Three steps from a new key to today’s calls.
The quickstart in the guide carries the same three steps in curl, Node, Python and PHP, with a small client to keep.
- 01
Make a key
On your company’s Integrations page in the portal, press Generate. A login that may edit the company sees the button.
- 02
Ask for today’s calls
One request with the key in its header brings today back, each call with its journey, summary and transcript.
- 03
Get events pushed
Create a webhook endpoint and choose its events. Each delivery is signed, and your server answers within five seconds.
curl "https://api.vocatech.com/v1/calls?limit=10" \
-H "Authorization: Bearer $VOCATECH_API_KEY"{
"calls": [{
"call_id": "8a1f3c2e-5b7d-4e9a-9c1b-2d4e6f8a0b1c",
"direction": "incoming",
"status": "answered",
"remote_name": "Jordan Reyes",
"remote_number": "7185550142",
"start_time": "2026-10-23T18:02:11.000Z",
"duration": 317,
"journey": [
{ "order": 1, "type": "auto_attendant", "extension_name": "Main Menu" },
{ "order": 2, "type": "user", "extension_name": "Maya Chen",
"summary": "Jordan asked about the March invoice. Maya sent a corrected copy.",
"recording_url": "https://api.vocatech.com/v1/media/rec_48213907" }
]
}],
"meta": { "page": 1, "limit": 10, "total_calls": 38 }
}Twelve areas, every one scoped to your account.
Twenty-eight operations behind one key. Lists page up to 500 records, dates default to today in New York time, and one request covers up to 366 days.
The API reads and sends. It does not change call settings such as forwarding or voicemail. Those live in the portal.
Seven jobs, each one working code in four languages.
Each recipe is a page of the guide with the request, the answer and what can go wrong, in curl, Node, Python and PHP.
Your own AI, on the same key and the same rules.
Hand the guide to the assistant that writes your code, or have your AI agent place a call from your own software.
Webhooks
Eleven events, every delivery signed.
Create an endpoint through the API, choose its events, and filter by extension or number. Answer within five seconds and do the work after. A failed delivery is tried five times over about two and a half hours, then listed for seven days, with no replay.
// Verify X-Vocatech-Signature, which reads t=<unix>,v1=<hex>.
// rawBody is the body exactly as it arrived, before any parsing.
import { createHmac, timingSafeEqual } from 'node:crypto';
export function verify(rawBody, header, secret) {
const parts = Object.fromEntries(
String(header).split(',').map((p) => p.split('='))
);
const t = Number(parts.t);
if (!t || !parts.v1) return false;
if (Math.abs(Date.now() / 1000 - t) > 300) return false;
const expected = Buffer.from(
createHmac('sha256', secret).update(`t=${parts.t}.${rawBody}`).digest('hex')
);
const given = Buffer.from(parts.v1);
// timingSafeEqual throws on unequal lengths, so check them first.
return given.length === expected.length && timingSafeEqual(given, expected);
}Keys you control. Limits you can read.
Each counter runs in fixed windows in UTC, and a refused request counts too. A 429 names the counter and the window, with the seconds to wait in Retry-After.
Keys you make yourself
The main key comes from your Integrations page and reaches every route. An API Messaging key, one per integrator, only texts.
Locked to your servers
List the exact addresses a key may use, IPv4 or IPv6, no ranges. Optional on the main key, required on a messaging key.
Every read on the record
Each read of calls, texts, faxes, recordings and callers is written to your account’s access log, with the key that made it.
A counter per kind
Reports, texts, faxes, AI agent calls, tickets and questions each count on their own, so one never uses up another.
An API Messaging key is not held to the 20 and the 200. Its batch is accepted and sent in order at a pace set per key. Faxes count per account, 3 a minute and 50 a day, each a PDF of at most 25 pages, and stop at the account’s monthly allowance. What metered texting costs is on the pricing page.
Questions developers ask us first.
“Does the API cost extra?”
No. The API, webhooks and contact directory are in every seat, with nothing to license. Only texting past the included allowance is metered, through a key of its own, and the pricing page says how.
“Where does the key come from?”
Your company’s Integrations page in the portal. A login that may edit the company presses Generate, the key shows there and is never emailed, and Regenerate replaces it at once.
“Can the API change our phone settings?”
No. It reads and sends. Forwarding, voicemail, menus and the rest are changed in the portal, and the API creates no logins. If you need something it does not do, tell us.
“Can we call it from a web page or an app?”
No. It is for servers only and sends no CORS headers, because a key in a browser is a key anyone can read. Call it from your server and keep the key in an environment variable.
“How do we test without sending anything?”
A text or a fax sent with test set to true is checked in full and sent nowhere. For a webhook, its test route sends your endpoint a signed test event at once, before any real one.
“What happens when our server is down?”
A failed delivery is tried five times over about two and a half hours, then stays listed at GET /v1/webhooks/failures for seven days, with no replay. Fill any gap from the call, message and fax lists.
“Can an AI write the integration for us?”
Yes, and the guide is written for it. Hand your assistant the plain-text guide and the OpenAPI file, and paste the rules on the AI page so its code is safe the first time.
“Is there a person to ask?”
Yes. Call or text 718.395.1550, or email office@vocatech.com, with the time, the path and the status you got. The people who built the API pick up. Never send us your key.
In every seat
Make a key, and start building.
The guide walks through every job with working code. The reference has every route with its fields, its answers and its errors.