Use the OpenAPI document with an AI agent

Load the production OpenAPI URL for operation IDs, paths, parameters, and response descriptions; use the request-fields guide for call-body requirements and pair each action with application-side safety policy.

Updated Oct 24, 2026v1Review areas: engineering and product

The canonical operation inventory is https://callonline.app/openapi.yaml. Import that URL rather than copying operation metadata into a prompt or repository. The current document lists operation IDs, paths, summaries, path parameters, and response descriptions; it does not define request-body schemas or security schemes. The API and documentation MCP operation lookup share the same structured operation registry.

Stable operation IDs

Important v1 IDs include:

Operation ID	Method and path	Purpose
`placeCall`	`POST /v1/calls`	Create a policy-controlled outbound call
`getCall`	`GET /v1/calls/{callId}`	Read current call and audit events
`cancelCall`	`POST /v1/calls/{callId}/cancel`	Stop an active call
`listVoices`	`GET /v1/voices`	Read voice-tier choices
`getCallOnlinePricing`	`GET /v1/pricing`	Read dynamic pricing and packages
`listWebhooks`	`GET /v1/webhooks`	List subscriptions
`createWebhook`	`POST /v1/webhooks`	Create a subscription
`deleteWebhook`	`DELETE /v1/webhooks/{webhookId}`	Delete a subscription

Agent-commerce operations are also present. Read their current capability response before assuming that a direct payment mode is available.

Pair schema with policy

OpenAPI describes callable operations, but it cannot prove that a call is appropriate. Add host-level instructions that require:

validated arguments from trusted application state;
explicit human confirmation before the first live call;
a server-side bearer key with minimal scopes;
refusal to invent or weaken compliance evidence;
a stop on compliance_blocked or configuration_error;
reconciliation before any retry of placeCall.

Recommended agent sequence

Retrieve placeCall through get_api_operation or the imported OpenAPI document.
Retrieve the compliant request guide.
Ask the application—not the model—for consent and caller records.
Validate the request body against the compliant request guide and your application’s request schema. The OpenAPI document does not currently include a request-body schema.
Present destination, objective, purpose, represented organization, recording choice, and estimated billing context for confirmation.
Call the operation once and persist the returned identifier.
Use getCall or verified webhooks for later state.

Keep secrets and raw results bounded

Do not paste API keys, signing secrets, unredacted transcripts, or sensitive metadata into a general-purpose agent conversation. Let the tool host attach credentials and redact results according to your data policy.

Detect contract drift

Fetch the OpenAPI document during CI and compare the operation IDs your integration relies on. If an expected operation disappears or its method/path changes, block deployment for review. Use the request-fields guide and application schema for request validation; the OpenAPI document is the current operation inventory, not a complete request contract.