Call2Me Authentication API

openapi: 3.2.0
info:
  title: Call2Me Authentication API
  description: '# Call2Me Voice AI Platform API


    Programmatic interface to build, deploy and operate voice AI agents that can place

    and receive phone calls in real time. Designed to be consumed by humans **and** by

    AI agent frameworks (function-calling LLMs, MCP servers, automation platforms like

    Composio, Pipedream, Zapier, n8n).


    ## What you can do


    - **Place outbound calls** — give an agent a phone number to dial; the AI handles

    the conversation end-to-end and returns a transcript + recording.

    - **Manage AI agents** — create personalities, attach voices, system prompts,

    knowledge bases and post-call actions.

    - **Schedule calls** — one-shot or recurring (cron-like) outbound calls.

    - **Knowledge base (RAG)** — upload documents/URLs so the agent answers from your

    data with reduced hallucination.

    - **Inbound** — provision phone numbers that route to your agents.


    ## Common LLM tool-calling use cases


    | Goal | Endpoint |

    |------|----------|

    | "Call this person and read them this script" | `POST /v1/calls` |

    | "Schedule a follow-up tomorrow at 14:00" | `POST /v1/schedules` |

    | "Get the transcript of last call" | `GET /v1/calls/{id}` |

    | "Add this PDF to the agent''s brain" | `POST /v1/knowledge-base/{id}/sources` |


    ## Authentication


    Every request requires a Bearer token issued from the dashboard:


    ```

    Authorization: Bearer c2m_sk_xxxxxxxxxxxxxxxx

    ```


    Get your API key from the API Keys page.

    Keys are scoped per-workspace and can be rotated/revoked any time.


    ## Rate Limits


    | Plan | Requests/min | Concurrent Calls |

    |------|-------------|------------------|

    | Free | 60 | 1 |

    | Pro | 600 | 10 |

    | Enterprise | Unlimited | Unlimited |


    ## SDKs & Integrations


    - Python SDK

    - Node.js SDK

    - OpenAPI 3.1 spec: `/openapi.json` (use it to generate clients or register the

    service with AI tool platforms)


    ## Support


    - Email: support@call2me.app

    - Docs: https://docs.call2me.app

    - Discord: https://discord.gg/call2me'
  version: 1.0.0
  x-logo:
    url: https://call2me.app/logo.png
    altText: Call2Me Logo
  contact:
    name: Call2Me Support
    url: https://call2me.app/support
    email: support@call2me.app
  license:
    name: Commercial — see Terms of Service
    url: https://call2me.app/terms
  termsOfService: https://call2me.app/terms
servers:
- url: https://api.call2me.app
  description: Production
- url: http://localhost:8000
  description: Local Development
security:
- BearerAuth: []
tags:
- name: Authentication
paths:
  /v1/auth/signup:
    post:
      tags:
      - Authentication
      summary: Signup
      description: Register a new user account.
      operationId: signup_v1_auth_signup_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SignupRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /v1/auth/invite/{token}:
    get:
      tags:
      - Authentication
      summary: Get Invite Info
      description: 'Davetin geçerliliğini ve kimin davet ettiğini döndürür.


        Kimlik doğrulaması YOK — davet linkine tıklayan henüz hesabı olmayan biri.

        Token''ın kendisi yetki: hash''i eşleşmezse hiçbir şey sızmaz. Geçersiz

        token''da 404 değil `valid=false` dönüyoruz; sayfa "bu davet geçersiz ya da

        süresi geçmiş" diyebilsin.'
      operationId: get_invite_info_v1_auth_invite__token__get
      parameters:
      - name: token
        in: path
        required: true
        schema:
          type: string
          title: Token
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InviteInfoResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /v1/auth/invite/accept:
    post:
      tags:
      - Authentication
      summary: Accept Invite
      description: 'Daveti kabul eder: hesabı açar, bayiye bağlar, başlangıç kredisini aktarır.


        Tenant ataması Origin header''ına DEĞİL davet kaydına dayanıyor: kişi hangi

        alan adından girerse girsin doğru bayiye yazılır.


        E-posta doğrulanmış sayılır — adresin sahibi olduğunu davet linkine

        erişerek zaten kanıtladı. Bu, üyeyi $5 hoş geldin bonusu kuyruğuna da

        sokmuyor: bonus bizim müşteri kazanımımız için, bayinin müşterisi için

        değil (kredisini bayi veriyor).'
      operationId: accept_invite_v1_auth_invite_accept_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AcceptInviteRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /v1/auth/login:
    post:
      tags:
      - Authentication
      summary: Login
      description: Login with email and password.
      operationId: login_v1_auth_login_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LoginRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /v1/auth/refresh:
    post:
      tags:
      - Authentication
      summary: Refresh Token
      description: 'Refresh access token using refresh token.


        Anahtar JSON gövdede (dashboard) ya da `Authorization: Bearer` başlığında

        (Chrome uzantısı lib/auth.js) gelir. Uzantı başlıkla gönderiyordu, uç

        yalnız gövde bekliyordu → 422 → uzantı her erişim süresi dolunca oturumu

        düşürüyordu (19 Eki). Mağazadaki eski uzantılar da bu sayede düzelir.'
      operationId: refresh_token_v1_auth_refresh_post
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
              - $ref: '#/components/schemas/RefreshRequest'
              - type: 'null'
              title: Request
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /v1/auth/logout:
    post:
      tags:
      - Authentication
      summary: Logout
      description: Logout - revoke refresh token if provided.
      operationId: logout_v1_auth_logout_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /v1/auth/forgot-password:
    post:
      tags:
      - Authentication
      summary: Forgot Password
      description: Send password reset email.
      operationId: forgot_password_v1_auth_forgot_password_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ForgotPasswordRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /v1/auth/reset-password:
    post:
      tags:
      - Authentication
      summary: Reset Password
      description: Reset password using token from email.
      operationId: reset_password_v1_auth_reset_password_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResetPasswordRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /v1/auth/me:
    get:
      tags:
      - Authentication
      summary: Get Current User
      description: Get current authenticated user.
      operationId: get_current_user_v1_auth_me_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /v1/auth/verify-email:
    post:
      tags:
      - Authentication
      summary: Verify Email
      description: 'Verify email address using token from email.


        Tokens expire after 24 hours. Clients that need a new one call

        /resend-verification which rotates the token and updates the timestamp.'
      operationId: verify_email_v1_auth_verify_email_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyEmailRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /v1/auth/resend-verification:
    post:
      tags:
      - Authentication
      summary: Resend Verification
      description: Resend email verification link.
      operationId: resend_verification_v1_auth_resend_verification_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResendVerificationRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /v1/auth/change-password:
    post:
      tags:
      - Authentication
      summary: Change Password
      description: Change password for authenticated user.
      operationId: change_password_v1_auth_change_password_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ChangePasswordRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /v1/auth/quick-login:
    post:
      tags:
      - Authentication
      summary: Create Quick Login
      description: 'Create a quick login link for a tenant member.


        The authenticated user (tenant owner) can create login links for members.

        If the member doesn''t exist, a new account is created automatically.

        The member is linked to the owner''s tenant and sees the owner''s branding.


        Requires authentication (JWT or API key).'
      operationId: create_quick_login_v1_auth_quick_login_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/QuickLoginRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QuickLoginResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /v1/auth/quick-login/verify:
    post:
      tags:
      - Authentication
      summary: Verify Quick Login
      description: 'Verify a quick login token and return JWT credentials.


        Called by the dashboard when user clicks the quick-login link.

        Token is single-use and time-limited.'
      operationId: verify_quick_login_v1_auth_quick_login_verify_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/QuickLoginVerifyRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /v1/auth/google:
    post:
      tags:
      - Authentication
      summary: Google Login
      description: Google ID token ile giriş/kayıt. Mevcut JWT+refresh döner.
      operationId: google_login_v1_auth_google_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GoogleLoginRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    Attribution:
      properties:
        referrer:
          anyOf:
          - type: string
            maxLength: 500
          - type: 'null'
          title: Referrer
        landing:
          anyOf:
          - type: string
            maxLength: 500
          - type: 'null'
          title: Landing
        utm_source:
          anyOf:
          - type: string
            maxLength: 200
          - type: 'null'
          title: Utm Source
        utm_medium:
          anyOf:
          - type: string
            maxLength: 200
          - type: 'null'
          title: Utm Medium
        utm_campaign:
          anyOf:
          - type: string
            maxLength: 200
          - type: 'null'
          title: Utm Campaign
        gclid:
          anyOf:
          - type: string
            maxLength: 200
          - type: 'null'
          title: Gclid
      type: object
      title: Attribution
      description: 'Where this user came from, captured in the browser on first touch.


        GA4 loses the source when a visitor crosses from call2me.app to

        dash.call2me.app, so every conversion landed in "Unassigned" and we

        could not say how our first paying customer found us (14 Aug 2026).

        This travels with the signup request instead, so attribution lives in

        our own DB — independent of analytics and ad blockers.


        Every field is optional: a direct visit legitimately has no referrer.

        Lengths are capped because these strings come from the client.'
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
      - loc
      - msg
      - type
      title: ValidationError
    ResendVerificationRequest:
      properties:
        email:
          type: string
          format: email
          title: Email
      type: object
      required:
      - email
      title: ResendVerificationRequest
      description: Resend verification email.
    AuthResponse:
      properties:
        access_token:
          type: string
          title: Access Token
        refresh_token:
          type: string
          title: Refresh Token
        token_type:
          type: string
          title: Token Type
          default: bearer
        expires_in:
          type: integer
          title: Expires In
        user:
          additionalProperties: true
          type: object
          title: User
      type: object
      required:
      - access_token
      - refresh_token
      - expires_in
      - user
      title: AuthResponse
      description: Authentication response with tokens.
    ChangePasswordRequest:
      properties:
        current_password:
          type: string
          title: Current Password
        new_password:
          type: string
          minLength: 8
          title: New Password
      type: object
      required:
      - current_password
      - new_password
      title: ChangePasswordRequest
      description: Change password request.
    QuickLoginResponse:
      properties:
        url:
          type: string
          title: Url
        expires_at:
          type: string
          title: Expires At
        user_id:
          type: string
          title: User Id
        is_new_user:
          type: boolean
          title: Is New User
      type: object
      required:
      - url
      - expires_at
      - user_id
      - is_new_user
      title: QuickLoginResponse
    QuickLoginRequest:
      properties:
        email:
          type: string
          format: email
          title: Email
        full_name:
          anyOf:
          - type: string
          - type: 'null'
          title: Full Name
        expires_hours:
          type: integer
          maximum: 168.0
          minimum: 1.0
          title: Expires Hours
          default: 24
      type: object
      required:
      - email
      title: QuickLoginRequest
      description: Create a quick login link for a tenant member.
    RefreshRequest:
      properties:
        refresh_token:
          type: string
          title: Refresh Token
      type: object
      required:
      - refresh_token
      title: RefreshRequest
      description: Token refresh request.
    InviteInfoResponse:
      properties:
        valid:
          type: boolean
          title: Valid
        email:
          anyOf:
          - type: string
          - type: 'null'
          title: Email
        brand:
          anyOf:
          - type: string
          - type: 'null'
          title: Brand
        initial_credit_usd:
          type: number
          title: Initial Credit Usd
          default: 0.0
        status:
          anyOf:
          - type: string
          - type: 'null'
          title: Status
      type: object
      required:
      - valid
      title: InviteInfoResponse
      description: Davet geçerli mi — kişi şifre belirlemeden önce sorulur.
    ResetPasswordRequest:
      properties:
        token:
          type: string
          title: Token
        new_password:
          type: string
          minLength: 8
          title: New Password
      type: object
      required:
      - token
      - new_password
      title: ResetPasswordRequest
      description: Reset password with token.
    LoginRequest:
      properties:
        email:
          type: string
          format: email
          title: Email
        password:
          type: string
          title: Password
      type: object
      required:
      - email
      - password
      title: LoginRequest
      description: User login request.
    QuickLoginVerifyRequest:
      properties:
        token:
          type: string
          title: Token
      type: object
      required:
      - token
      title: QuickLoginVerifyRequest
    GoogleLoginRequest:
      properties:
        credential:
          type: string
          title: Credential
        attribution:
          anyOf:
          - $ref: '#/components/schemas/Attribution'
          - type: 'null'
      type: object
      required:
      - credential
      title: GoogleLoginRequest
    SignupRequest:
      properties:
        email:
          type: string
          format: email
          title: Email
        password:
          type: string
          minLength: 8
          title: Password
          description: Minimum 8 characters, max 72 bytes
        full_name:
          anyOf:
          - type: string
          - type: 'null'
          title: Full Name
        attribution:
          anyOf:
          - $ref: '#/components/schemas/Attribution'
          - type: 'null'
      type: object
      required:
      - email
      - password
      title: SignupRequest
      description: User registration request.
    ForgotPasswordRequest:
      properties:
        email:
          type: string
          format: email
          title: Email
      type: object
      required:
      - email
      title: ForgotPasswordRequest
      description: Forgot password request.
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    VerifyEmailRequest:
      properties:
        token:
          type: string
          title: Token
      type: object
      required:
      - token
      title: VerifyEmailRequest
      description: Verify email with token.
    AcceptInviteRequest:
      properties:
        token:
          type: string
          maxLength: 128
          minLength: 20
          title: Token
        password:
          type: string
          maxLength: 200
          minLength: 8
          title: Password
        full_name:
          anyOf:
          - type: string
            maxLength: 255
          - type: 'null'
          title: Full Name
      type: object
      required:
      - token
      - password
      title: AcceptInviteRequest
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: API Key
      description: Enter your API key
externalDocs:
  description: Full developer documentation
  url: https://docs.call2me.app