VocalDocscontracts 1.65.0

Send a control command to the live Session of a Call

POST /v1/calls/{call_id}/control

PropertyValue
Operationcontrol_call
GroupCalls
Scopecalls:write
Route classcontrol
IdempotencyIdempotency-Key accepted: a retry with the same key replays the first answer
AuditAudited call.control (mutation)
Released in1.49.0
Phase 0 hostServed (the hosted api pins 1.65.0)

Sends one command (say, transfer, end or inject_context) to the live Session and answers 202 with the command id once the Session acknowledges it, within 2 seconds (a target), or 503 session_unreachable. A Call that is not live answers 409 call_not_active. The command passes through the same Policies as model output, and its outcome arrives as command.completed on the events channel. From 1.50.0 transfer is built, cold only: a destination key the pinned Agent version does not name, or that the transfer allowlist of the Organization does not hold, is refused with 403 transfer_refused before anything is relayed, and recorded as the Call event transfer.refused; a 1.49.0 api answered capability_not_available. Every command writes an Audit event, never its text, and a refused transfer writes it denied.

Request

Set VOCAL_API to the base URL of your API and VOCAL_API_KEY to an API key with the calls:write scope (Authentication and keys). Replace each placeholder, such as agt_... or <name>, with your own value.

curl -X POST "$VOCAL_API/v1/calls/call_.../control" \
  -H "Authorization: Bearer $VOCAL_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{ "type": "say", "text": "<text>" }'

Parameters

NameInTypeRequiredDescription
call_idpathCallIdyesThe id of a Call: call_ and the row's UUIDv7 in 26 Crockford base32 characters. Opaque and safe to log.
idempotency-keyheaderstringnoA client-chosen key, kept 24 hours per Organization, environment and route. A replay returns the stored response.

Request body

Content type application/json, required: ControlCommand.

Responses

StatusContent typeShapeError codes
202application/jsonControlCommandResult
400application/jsonErrorEnvelopeinvalid_request
401application/jsonErrorEnvelopeunauthenticated
403application/jsonErrorEnvelopeforbidden, org_suspended, transfer_refused
404application/jsonErrorEnvelopenot_found
409application/jsonErrorEnvelopecall_not_active, idempotency_in_progress, idempotency_key_reused
422application/jsonErrorEnvelopevalidation_failed, capability_not_available
429application/jsonErrorEnveloperate_limited
500application/jsonErrorEnvelopeinternal_error
503application/jsonErrorEnvelopesession_unreachable

Fields of the 202 answer

The shape is ControlCommandResult.

FieldTypeRequiredDescription
accepted_atTimestampyes
call_idCallIdyes
idControlCommandIdyes
object"control_command"yes
status"accepted"yesThe Session acknowledged the command and queued it; not that the caller heard it. The outcome arrives as command.completed on the events channel.
typeControlCommandTypeyes