# CallOnline

> Public product and integration documentation for the CallOnline phone API.

Use the canonical HTML pages for human browsing and the Markdown companions below for direct retrieval. Technical behavior is versioned as v1; compliance guidance describes product controls and is not legal advice.

## Documentation

- [Use CallOnline through MCP](https://callonline.app/resources/agents/use-callonline-through-mcp.md): Point an MCP client at /mcp, discover the stateless server or use legacy initialization, use the three public documentation tools for grounded answers, and attach a scoped bearer key only for protected account actions.
- [Use the OpenAPI document with an AI agent](https://callonline.app/resources/agents/use-openapi-with-ai-agent.md): Load the production OpenAPI URL as the operation contract, address operations by their stable operationId, validate generated arguments, and pair each action with the relevant human guide and application-side safety policy.
- [Create and protect a CallOnline API key](https://callonline.app/resources/authentication/api-key-security.md): Create a key in App9 Account, grant only the scopes the integration needs, store the value in a server-side secret manager, and rotate it immediately if it appears in a client bundle, log, ticket, or repository.
- [Credits, billing readiness, and dynamic pricing](https://callonline.app/resources/billing/credits-billing-and-pricing.md): Read /v1/pricing for current rates and packages, use the billing-status endpoint with a billing-scoped key, and confirm available credits, commerce state, spend cap, and compliance readiness before calling.
- [API errors and safe retry limits](https://callonline.app/resources/calls/api-errors-and-safe-retries.md): Retry read operations conservatively after transient failures, but do not blindly retry POST /v1/calls because v1 has no idempotency contract; first reconcile any saved call ID, webhook, or application record.
- [Call lifecycle and status values](https://callonline.app/resources/calls/call-lifecycle-statuses.md): A call can move through dialing, dialed, initiated, ringing, and answered before ending; canceled, dial_failed, compliance_blocked, configuration_error, and ended represent outcomes that require no normal forward transition.
- [Required fields for a compliant call request](https://callonline.app/resources/calls/compliant-call-request-fields.md): A call request needs a destination, objective, and compliance object containing the true purpose, consent evidence, called-party context, caller identity, disclosure acknowledgements, and recording choice.
- [Place your first outbound AI phone call](https://callonline.app/resources/getting-started/first-outbound-call.md): Send one authenticated POST request with a destination, objective, consent evidence, caller identity, local-time context, and recording choice; save the returned call ID before polling or waiting for a webhook.
- [What CallOnline does and when to use it](https://callonline.app/resources/getting-started/product-overview.md): CallOnline gives an authorized AI workflow a phone interface for outbound calls, policy preflight, status tracking, and structured events; it is best for specific, reviewable tasks rather than unrestricted calling.
- [CallOnline knowledge base](https://callonline.app/resources/index.md): Start with a tested workflow, then use focused references for call states, compliance inputs, webhooks, agent integrations, and billing readiness.
- [Troubleshoot compliance and preflight blocks](https://callonline.app/resources/troubleshooting/compliance-preflight-blocks.md): Read every item in the 403 blocks array, fix the actual phone format, consent record, DNC context, local time, or compliance-store issue, and submit a new call only after the workflow is approved.
- [Troubleshoot missing or delayed webhooks](https://callonline.app/resources/troubleshooting/missing-delayed-webhooks.md): Confirm the subscription is active and matches the emitted event, inspect receiver status and signature verification, deduplicate rather than discard repeats, and reconcile the call through GET /v1/calls/{callId}.
- [Receive call-status webhooks](https://callonline.app/resources/webhooks/receive-call-status-webhooks.md): Register an HTTPS endpoint with one or more event types, save the returned signing secret, verify each raw delivery, deduplicate its delivery ID, and return a successful response only after durable acceptance.
- [Verify webhook signatures and handle retries](https://callonline.app/resources/webhooks/verify-signatures-and-retries.md): Compute HMAC-SHA256 with the subscription secret and exact raw body, compare the lowercase `sha256=` value in constant time, then deduplicate `x-callonline-delivery` before applying side effects.

## Machine interfaces

- [OpenAPI](https://callonline.app/openapi.yaml)
- [MCP endpoint](https://callonline.app/mcp)
- [Documentation index](https://callonline.app/resources/docs-index.json)