Use the OpenAPI document with an AI agent

Load the production OpenAPI URL as the operation contract, address operations by their stable operationId, validate generated arguments, and pair each action with the relevant human guide and application-side safety policy.

Updated Jul 14, 2026v1Reviewed by engineering and product

The canonical contract is https://callonline.app/openapi.yaml. Import that URL rather than copying a stale schema into a prompt or repository. The API and documentation MCP operation lookup share the same structured operation registry.

Stable operation IDs

Important v1 IDs include:

Operation ID	Method and path	Purpose
`placeCall`	`POST /v1/calls`	Create a policy-controlled outbound call
`getCall`	`GET /v1/calls/{callId}`	Read current call and audit events
`cancelCall`	`POST /v1/calls/{callId}/cancel`	Stop an active call
`listVoices`	`GET /v1/voices`	Read voice-tier choices
`getCallOnlinePricing`	`GET /v1/pricing`	Read dynamic pricing and packages
`listWebhooks`	`GET /v1/webhooks`	List subscriptions
`createWebhook`	`POST /v1/webhooks`	Create a subscription
`deleteWebhook`	`DELETE /v1/webhooks/{webhookId}`	Delete a subscription

Agent-commerce operations are also present. Read their current capability response before assuming that a direct payment mode is available.

Pair schema with policy

OpenAPI describes callable operations, but it cannot prove that a call is appropriate. Add host-level instructions that require:

validated arguments from trusted application state;
explicit human confirmation before the first live call;
a server-side bearer key with minimal scopes;
refusal to invent or weaken compliance evidence;
a stop on compliance_blocked or configuration_error;
reconciliation before any retry of placeCall.

Recommended agent sequence

Retrieve placeCall through get_api_operation or the imported OpenAPI document.
Retrieve the compliant request guide.
Ask the application—not the model—for consent and caller records.
Validate the object against the operation schema.
Present destination, objective, purpose, represented organization, recording choice, and estimated billing context for confirmation.
Call the operation once and persist the returned identifier.
Use getCall or verified webhooks for later state.

Keep secrets and raw results bounded

Do not paste API keys, signing secrets, unredacted transcripts, or sensitive metadata into a general-purpose agent conversation. Let the tool host attach credentials and redact results according to your data policy.

Detect contract drift

Fetch the OpenAPI document during CI and compare the operation IDs your integration relies on. If an expected operation disappears or its method/path changes, block deployment for review. Use the documentation guide for semantics and the live OpenAPI document for the current machine contract.