KaiCalls Update Requests API

openapi: 3.2.0
info:
  title: KaiCalls Public Update Requests API
  version: '2026-06-05'
  description: Machine-readable surface for KaiCalls external developers and client agents.
servers:
- url: https://www.kaicalls.com/api
security:
- bearerAuth: []
tags:
- name: Update Requests
paths:
  /v1/update-requests:
    post:
      summary: On-behalf update broker.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/updateRequest'
      responses:
        '200':
          description: Executed (or dry-run validated) update request.
        '202':
          description: Accepted but needs approval/authority (needs_approval or pending_approval).
        '400':
          description: needs_user_input or unsupported intent/fields.
        '403':
          description: denied (tenant, scope, or object authorization failed).
        '409':
          description: idempotency_conflict, rejected, or expired.
      tags:
      - Update Requests
      operationId: postV1UpdateRequests
      x-operation-id-source: derived
components:
  schemas:
    updateRequest:
      $schema: https://json-schema.org/draft/2020-12/schema
      $id: https://www.kaicalls.com/api/v1/schemas/updateRequest
      title: On-Behalf Update Request
      description: Governed mutation request for the KaiCalls update broker. Carries the safety envelope (idempotency_key, actor, authority) required for auditable on-behalf changes.
      type: object
      additionalProperties: true
      required:
      - intent
      properties:
        intent:
          type: string
          enum:
          - phone.emergency_address.set
          - transcripts.sink.configure
          - agent.patch
        business_id:
          type: string
          format: uuid
        target:
          type: object
          additionalProperties: true
        payload:
          type: object
          additionalProperties: true
        idempotency_key:
          type: string
          minLength: 1
          description: Required for mutating requests; replays return the original outcome.
        actor:
          type: object
          additionalProperties: false
          properties:
            type:
              type: string
              enum:
              - agent
              - human
              - system
              - integration
            id:
              type: string
            display_name:
              type: string
        authority:
          type: object
          additionalProperties: false
          properties:
            mode:
              type: string
              enum:
              - none
              - agent_asserted
              - human_confirmed
              - dashboard_session
              - system_policy
            confirmed_by:
              type: string
            confirmed_at:
              type: string
              format: date-time
            confirmation_ref:
              type: string
        dry_run:
          type: boolean
        queue_for_approval:
          type: boolean
        reason:
          type: string
        source_ref:
          type: string
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: 'KaiCalls API key. Per-operation scope requirements are published on each operation as `x-required-scopes` — a scope string, or a nested `{ allOf: [...] }` / `{ anyOf: [...] }` expression. An operation with no `x-required-scopes` requires a valid key but no particular scope.'
      x-scopes:
      - workspaces:read
      - workspaces:write
      - numbers:read
      - numbers:write
      - agents:read
      - agents:write
      - communication-runs:read
      - communication-runs:write
      - calls:read
      - calls:write
      - sms:read
      - sms:write
      - webhooks:read
      - webhooks:write
      - events:read
      - events:replay
      - lifecycle:write
      - leads:read
      - leads:write
      - emails:read
      - emails:write
      - sdr:read
      - sdr:write
      - evals:read
      - evals:write
      - appointments:read
      - appointments:write
      - knowledge:read
      - knowledge:write
      - products:read
      - products:write
      - integrations:write
      - approvals:write
      - concierge:write
      - billing:read
      - billing:write
      - call_evidence:read
      - call_evidence:write
      - support:write
    sessionAuth:
      type: apiKey
      in: cookie
      name: sb-access-token
      description: Authenticated dashboard session cookie. Used by first-party flows that mint or manage API keys.