Changelog

Changes to the API, newest first. We add fields to responses and webhooks without notice; build your code to ignore fields it does not know.

Next release Pre-release

• Reads for integrations. GET /v1/orders lists orders (finished ones by default, newest first, filtered by status, since and agent_id, up to 100 at a time). GET /v1/me tells which workspace a key belongs to and whether it is live or test. GET /v1/agents lists the agents that can take orders. They power the Zapier and Make apps, and share a limit of 120 requests a minute per workspace.

16 October 2026 Pre-release

• Follow-up plan per agent. Each agent now has its own follow-up plan (attempts, wait, fallback text on or off). An order made through the trigger URL uses it (it was fixed at 3 attempts, 120 minutes, text on). In POST /v1/orders, a cadence field you leave out now takes the agent's value; a field you send still overrides it. Agents you have not changed keep 3, 120 and on, so nothing changes until you edit a plan.
• Business calling hours. Calls and retries also wait for the calling hours set for the agent or the workspace (always inside the lead's 8am-8pm).
• 402 plan_inactive is returned when the account's plan is not active (it was reported as insufficient_balance).

15 October 2026 Pre-release

• Test mode. av_test_ keys now create test orders: no call, no text, no charge, a simulated call chosen by the last four digits of the number (0001 booked, 0002 voicemail then booked, 0003 not interested), and webhooks with "test": true. See Test keys.
• US numbers only, enforced. Canadian and Caribbean +1 numbers, and numbers we have no rate for, are refused with 422 unsupported_destination (it was 400 for non-+1 numbers, and some +1 countries were accepted). Queued orders are checked again before each dial.
• reason field in GET /v1/orders/{order_id} and in webhooks: why an order waits or failed, null when there is nothing to report. An order waiting for wallet balance or an active plan now sends one order.updated with reason set.
• test field in webhooks and GET /v1/orders/{order_id}.
• Review fixes. Every current US area code is accepted, including overlays our rate table has no row for yet (US mainland, Alaska, Hawaii; US territories are not called yet). Test events never go to the production default webhook: they use the order's webhook_url or a separate workspace test webhook URL. 409 idempotency_key_conflict when a key is reused across test and live. At most 500 test orders per workspace per 24 hours (429 rate_limited). An order that fails before dialling now sends order.completed. Fallback and transactional texts refuse numbers outside the US the same way calls do.
• Recording retention. Recordings are deleted 30 days after the call by default (1 to 365 days, or keep, per workspace); afterwards the recording endpoints answer 410 recording_deleted.
• API keys in the dashboard. Owners and admins create live or test keys (shown once), name, rename and revoke them; at most 20 active keys per workspace and 20 new keys per hour. A revoked key gets 401 on the next request. See Managing keys.
• Webhook settings in the dashboard. Owners and admins set the default and test webhook URLs (checked against private addresses, including their IPv6 forms, when saved), view the signing secret, and send a signed sample order.completed with "test": true (10 per hour). See Webhook settings.
• Signing secret rotation. A new secret can be made at any time; for up to 24 hours afterwards each delivery carries a second v1 signed with the old secret, so X-Avoonta-Signature can now hold more than one v1. Accept the request when any v1 matches. See Rotating the secret.

v1: initial release Pre-release

14 October 2026. The first version of the API. It is built but not yet live at api.avoonta.com.

• POST /v1/orders: create a call order with a required consent object, an optional cadence (1 to 3 attempts), an optional per-order webhook_url, and Idempotency-Key support.
• GET /v1/orders/{order_id}: read one order and its result.
• POST /v1/hooks/lead/{token}: the no-code trigger URL, with consent attestation, 24-hour duplicate detection, a 60-per-minute limit and test leads (?test=1).
• Result webhooks order.completed and order.updated, signed with X-Avoonta-Signature (t=, v1= HMAC-SHA256), retried for about 15 hours.
• GET /v1/recordings/{order_id}.mp3 and /link.
• US numbers only. Calling hours 8am to 8pm in the lead's time. Locked AI disclosure on every call.

Not in v1 yet

• Creating and revoking API keys, setting the default webhook URL and viewing the signing secret in the dashboard (added 15 October 2026).
• Listing, searching and cancelling orders through the API.
• A do-not-contact API.
• A "send test event" button for webhooks (added 15 October 2026).