Changelog

What changes in the API, dated. Nothing is removed from v1 without notice here first.

2026-11-07 — Company-wide settings need an owner or admin

Webhook subscriptions (/v1/webhooks, every route) are for an owner or admin of the company, as in the app: a user token or an API key must have an active owner or admin behind it (the company's own app may too). Each filter needs its read scope (recordings.ready needs recordings:read, a sensitive scope); otherwise 403 insufficient_scope.
GET/PUT /v1/browser-phone/origins: an owner or admin of the company (or the company's own app); a change is written to the company log, as in the app.
POST /v1/browser-phone/sessions: a session for someone else needs an owner or admin behind the credential (an API key acts as the person who created it), and only the owner may open one on the owner's line; the company's own app opens the owner's line only when the owner registered it.

A dialer in your page registers a line over wss://a1merica.ai/sip-ws and carries the audio (WebRTC); to the platform it is a phone on the line. See Browser phone.
Routes POST/DELETE /v1/browser-phone/sessions, GET /v1/browser-phone/ice, GET/PUT /v1/browser-phone/origins; scopes phone:browser and phone:manage (not sensitive).
A session lasts until you revoke it unless you ask for a lifetime (ttl_hours, 1 hour to a year); we never revoke what you configured.
In the app: Developer → Browser phone (allowed web addresses, device passwords, the steps).

New host https://api.a1merica.ai/v1 with stable public shapes: users, numbers, devices, calls (including live-call control), recordings, transcripts, presence, messages, conversations, voicemails, faxes, webhooks, account.
OAuth 2.0: authorization code + PKCE, client credentials, refresh with rotation, revocation, introspection. Apps are registered under Developer → Apps; sensitive scopes on approval for third-party apps.
Twenty-one scopes (table); existing keys keep their names and are accepted by v1.
Second-generation webhooks: handshake at creation, filters by family, renewable expiry, suspension after 20 failures, test.ping, a delivery log. Same signature as before.
Cursor pagination, sync tokens, rate tiers with headers, one error envelope, X-Request-Id.
A sandbox per app: a demo company that is never billed, resettable, with its own key.
This site, and the reference generated from /v1/openapi.json.

aim_live_… keys with seven scopes over the app's API (/voip/api); 60 requests a minute per key.
Signed outbound webhooks (X-AIMERICA-Signature: t=…,v1=…) for nine events, and Slack.