---
title: "Mint Softphone Token"
method: GET
path: "/dialer/sessions/token"
tags: ["Dialer"]
---

# Mint Softphone Token

`GET /dialer/sessions/token`

## Request

- Base URL: `https://be.graph8.com/api/v1`
- URL: `https://be.graph8.com/api/v1/dialer/sessions/token`
- Auth: HTTP bearer

CONTACTS NOBODY - but the RESPONSE CAN. Mints a softphone credential.

Returns a short-lived (1 hour) Twilio access token carrying a VoiceGrant,
for a browser running the Twilio Voice SDK. Whoever holds it can register a
device and place and receive calls as `sdr_{user_id}_{org}` until it
expires. TREAT THE RESPONSE AS A SECRET: it is a bearer credential, not a
description of one.

That is why this is the one GET on this router tiered `external` instead of
`read`, and why it gates on `voice:calls:place` rather than a read
permission - a read-only key must not be able to mint the ability to dial.

`user_id` is REQUIRED here although voice defaults it. An organisation API
key has no user of its own, and defaulting would mint a credential for an
identity nobody named. The organisation half of the identity is always the
key's own and cannot be supplied.

## Query parameters

- `user_id` string, required: The rep this softphone credential is for.

## Headers

- `Authorization` string, nullable
- `X-Target-Org-Id` string, nullable

## Response `200`

Successful Response

- ApiResponseDialerPayload
  - `data` DialerPayload, required: An open envelope for one dialer result. Open because voice owns the shape of a session, a call stub and a queue stat, and it grows them without a contract bump here. A dropped field would otherwise turn an added upstream field into a removed public one.
  - `pagination` PaginationMeta
    - `page` integer, required: Current page number (1-indexed)
    - `limit` integer, required: Items per page
    - `total` integer, required: Total number of items
    - `has_next` boolean, required: Whether there are more pages
    - `next_cursor` string, nullable: Opaque cursor for the next page; null when there are no more items. Pass it back as the `cursor` query param to fetch the following page without computing page numbers.
    - `total_available` integer, nullable: Search endpoints only: how many records really match, when known. Can be larger than `total`, which is capped at the 10,000 results that can be paged. For company search this is a distinct-company estimate. Null when unknown; absent outside search.
    - `total_is_lower_bound` boolean, nullable: Search endpoints only: true when more records match than `total` shows (the result set is larger than the 10,000 results that can be paged). Absent outside search.
    - `notes` string[], nullable: Search endpoints only: plain-language notes about the result, e.g. that more records match than can be paged, or that a reversed `between` range was put in order.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/graph8/apis/graph8-developer-api.md) · [All operations](https://skmtc.dev/graph8/apis/graph8-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/graph8/apis/graph8-developer-api/revisions/89fc11143b70?raw)