What “Open” Actually Means
Nearly every phone provider now claims to have an API. The word does a lot of quiet work, so it is worth defining what we mean by it — and what the alternatives look like in practice.
| A closed platform with an API | An open platform | |
|---|---|---|
| What is exposed | A subset the vendor chose, usually read-only reporting | The operations the portal itself performs |
| Provisioning | Raise a ticket. Wait | An API call. Seconds |
| Your call data | Viewable in the portal, exportable as a CSV if you are lucky | Queryable and exportable in bulk, whenever you want, in a format you can process |
| Building something new | Submit a feature request into a roadmap you do not control | Build it. Today. Without asking |
| Integration approval | Partner programmes, certification, commercial gatekeeping | Credentials and documentation |
| If you leave | Your history stays behind | You take your data and your numbers with you |
Why we treat this as a commercial position, not a feature
An API that only exposes what the vendor finds convenient is a permission system wearing an engineering costume. It lets a provider say yes to the question while retaining the ability to say no to everything specific. The test of an open platform is not whether an API exists — it is whether you can do something the vendor never anticipated, without asking. That is the commitment, and everything below follows from it.
There is a self-interested version of this argument and we will make it honestly: a platform that holds your data hostage does not have to be good, because leaving is painful. A platform that hands your data back on request has to earn the renewal every year. We would rather compete on the second basis.
The Surface, End to End
Four families of capability. Most teams start with one and add the others as they find uses for them.
Voice operations
Originate a call from your own application, query call detail records, retrieve recordings, and control routing behaviour. Everything from a click-to-call button on your CRM to an automated outbound workflow.
Messaging operations
Send SMS from your business number, receive inbound replies delivered to your systems, and get delivery status back so your application knows what actually landed.
Account and provisioning
Order numbers, create extensions and users, adjust routing, manage queues. The things that traditionally required a support ticket at a telco, done from your code in seconds.
Events and AI data
Webhooks that push call and message events to your endpoint as they occur, plus access to AI-derived transcripts and summaries as structured data rather than as something to read on a screen.
On the examples in this article
The payload shapes and field names shown below are illustrative — they show the pattern rather than a literal contract. Exact resource paths, field names, authentication details, rate limits and versioning are in the developer documentation issued with your API credentials. Ask for the docs before you commit to an architecture; any provider unwilling to show them before you sign is telling you something.
Voice: Calls, Numbers and Records
Voice is the part most often locked down elsewhere, because it is where the vendor's own product lives. Four things matter.
| Capability | What it does | What it is used for |
|---|---|---|
| Click-to-call origination | Your application asks the platform to connect a user to a number. The user's device rings, then the destination | Dial buttons in a CRM, a web app or an internal tool. Removes mis-dials and captures every call against a record automatically |
| Call detail records | Query calls by time, number, user, direction, duration and outcome | Custom reporting, wallboards, feeding a data warehouse, attribution, invoicing clients for time on calls |
| Recordings and transcripts | Retrieve the audio, and where AI transcription is enabled, the text and a structured summary | Compliance archives, quality review, writing call notes into a CRM automatically |
| Numbers, users and routing | Order a number, create a user, change where a number points, adjust a queue | Onboarding automation, multi-site rollouts, campaign numbers spun up and torn down programmatically |
The one that changes how a business operates
Provisioning without a ticket. At a traditional telco, adding a number or a user is a request that goes into a queue and comes back in days. When it is an API call, a new staff member can be fully provisioned by your HR system the moment their start date arrives — extension, number, queue membership, app login — and de-provisioned automatically when they leave. That second half is a security control, not a convenience. Offboarding is the step everyone forgets manually and nobody forgets when it is automated.
SMS: Send, Receive, and Know
Messaging over an API is deceptively simple to start and easy to get wrong at scale. Three capabilities, and a fourth thing that separates a real implementation from a demo.
| Capability | Detail |
|---|---|
| Outbound send | Post a message with a destination, a body and the sending identity. Long messages concatenate; unicode changes the segment length, which affects cost — worth handling in your code rather than discovering on an invoice |
| Two-way receive | Inbound messages to your business number delivered to your systems as they arrive. This is what turns SMS from a broadcast channel into a conversation, and it is the half most implementations skip |
| Delivery status | Status updates telling you what was accepted, delivered, or failed and why. Without this you are sending into the dark and assuming it worked |
| Sender identity | Whether the message shows a number or your registered business name. In Australia this now carries a regulatory obligation — see the compliance section below |
The mistake that costs the most
Sending without handling replies. If a customer can receive a message from your business, they will reply to it — with a question, a reschedule, or STOP. An outbound-only implementation produces a channel where customers talk and nobody listens, which is worse for the relationship than not messaging at all. Wire up inbound on day one, even if all it does initially is drop the message into a shared inbox and notify someone.
Practical note on the two-way path: the same number your customers ring should be the number they can message. Splitting voice and SMS across different identities confuses people and quietly halves your response rate. Our guide to business SMS from your phone system covers the non-API side of the same channel.
Events: Your Systems, the Instant It Happens
Everything above is your code asking us a question. Webhooks are us telling you something without being asked, which is the difference between a system that reports and a system that reacts.
When something happens on your account, we post a payload to a URL you nominate. Illustrative shape:
| Field | Example value | Why you want it |
|---|---|---|
event | call.missed | What happened. Your handler switches on this |
call_id | a1b2c3… | Ties every event about one call together, and ties back to the record and recording |
from / to | +61… | Look the caller up in your CRM before doing anything else |
direction | inbound | Different handling for calls you made versus calls you received |
timestamp | ISO 8601, UTC | Ordering, deduplication and reporting |
duration | seconds | Present on completion events |
The event types that carry the most value in practice:
| Event | What teams do with it |
|---|---|
| Call started / answered | Screen pop the customer record before the second ring. The single most-noticed integration by customers, because it turns “can I take your name?” into “morning Sarah” |
| Call missed | Fire an automatic SMS offering a callback, create a task, alert a channel. For trades and service businesses this is routinely the highest-return automation in the entire stack |
| Voicemail left | Push the audio and transcription straight into a ticket or CRM record so nobody has to listen to a mailbox |
| Message received | Route an inbound SMS to the right person or queue, or into your helpdesk as a conversation |
| Transcript ready | Write the call notes and follow-up actions into the customer record automatically. This is the one that removes admin nobody was doing anyway |
Three things to build into any webhook consumer
Verify the signature so you only act on payloads that genuinely came from us. Respond fast and process asynchronously — acknowledge, queue, then do the work, because slow handlers cause retries. And expect duplicates: any at-least-once delivery system will occasionally send an event twice, so make your handler idempotent using the event or call identifier. These three account for the overwhelming majority of integration bugs we see.
What Staying in Control Means
“You stay in control” is easy to write on a website. Here is what we mean by it, stated as commitments you can test.
Your data is yours, in bulk
Call records, recordings, transcripts and message history are exportable on demand, in a machine-readable form. Not a screenshot, not a paginated portal view, not a fee.
No ticket for routine change
Numbers, users, extensions and routing are yours to provision. A platform that makes you ask permission to add a user has made itself a bottleneck in your business.
No approval to build
There is no certification programme standing between you and a working integration. Credentials and documentation, then build whatever your business actually needs.
Your numbers are portable
Under the industry Local Number Portability framework your numbers belong to your business. An API-first platform should make leaving technically easy, and we do.
Australian infrastructure
The platform and the network are ours and they are here. That matters for latency, for support escalation, and for answering the question of where your call data is processed.
No code is a first-class path too
Not every team has developers. Zapier, Make and Power Automate reach the same triggers and actions, so the same events drive automation without anyone writing a line.
Ask any provider these four questions
Can I export all my call records and recordings, in bulk, without asking? Can I provision a number and a user from the API? Can I see the API documentation before I sign? Is there an approval process for a custom integration? The answers separate open platforms from platforms with an API, and none of them require a technical conversation.
Seven Things Teams Build in a Week
None of these are ambitious. All of them are things businesses tell us paid for themselves quickly.
| # | What it does | How |
|---|---|---|
| 1 | Missed-call auto-response. An unanswered call triggers an immediate SMS offering a callback | Missed-call webhook → send SMS. About twenty lines of code, and the highest return of anything on this list |
| 2 | Appointment reminders that accept replies. Reminder goes out the day before; the customer can reply to confirm or reschedule | Scheduled send from your booking system + inbound message webhook to process the reply |
| 3 | Screen pop. The customer record opens before anyone picks up | Call-started webhook → look up by number → open the record in your CRM |
| 4 | Automatic call notes. Every call writes itself to the customer record with a summary and actions | Transcript-ready webhook → write to CRM. Removes admin that mostly was not happening anyway |
| 5 | Starter and leaver automation. HR system provisions and de-provisions phone access | Provisioning API calls triggered by your HR platform. The offboarding half is a genuine security control |
| 6 | Campaign attribution. Different numbers on different campaigns, all reporting into one place | Provision numbers via API, query call records, join on the number. You finally know which spend generates calls rather than clicks |
| 7 | Operational alerting. A queue exceeds a wait threshold and the right person is told immediately | Call events into your monitoring or chat tool. Turns a report you read on Friday into an intervention on Tuesday |
4
Capability families
7
Builds inside a week
0
Approvals required
1
Company behind all of it
Number one deserves emphasis because of how disproportionate it is. A missed call is a customer who wanted to buy something and could not reach you. An SMS arriving twenty seconds later — before they have rung the next business on the list — converts a meaningful share of them. It is roughly a morning's work. The arithmetic on missed calls makes the case better than we can here.
The Australian Layer
Once you are sending programmatically you are operating at a scale where Australian rules apply properly. None of this is difficult — but it is far cheaper to build in at the start than to retrofit.
| Requirement | What applies | Build it in as |
|---|---|---|
| SMS Sender ID Register | Since 1 July 2026, alphanumeric sender IDs — your business name at the top of a message — must be registered before use with Australian mobile numbers. Messages sent using unregistered branded sender IDs are labelled “Unverified”. Registration is completed through a participating telco or messaging provider | Register the sender IDs you intend to use before you write the send code. Treat an unregistered sender ID as a configuration error, not a warning |
| Consent | The Spam Act 2003 requires consent for commercial electronic messages, whether express or reasonably inferred | Store the consent basis and its timestamp against the contact, and have your send path check it. Transactional messages and marketing are not the same thing — but your code needs to know which is which |
| Identify the sender | Commercial messages must clearly identify who sent them and how to contact them | A template rule, enforced centrally rather than left to whoever writes each message |
| Unsubscribe | A functional, low-cost unsubscribe facility that is honoured | Handle STOP in your inbound webhook, suppress at the send layer, and make suppression global rather than per-campaign |
| Voice marketing | The Do Not Call Register applies to telemarketing calls, with its own washing obligations and permitted exemptions | Wash your outbound lists before any automated dialling, and log that you did |
| Emergency calls | Programmatic call origination must never sit between someone and an emergency service | Exclude emergency numbers from any automated flow, and verify service addresses per site |
Build suppression at the send layer, not the campaign layer
The most common and most expensive compliance failure in API messaging is an opt-out honoured in one system and not another, so a customer who replied STOP receives the next campaign from a different code path. Put the check in the one function every message goes through. If there is more than one way to send a message in your codebase, that is the actual bug.
Our detailed treatments: the SMS Sender ID Register, what the “Unverified” label means, and outbound calling and the Do Not Call Register.
Where This Goes Next
One development is worth planning for, because it changes what your call data is worth.
AI agents are moving from answering questions to taking actions, and they need a standard way to reach business systems. The Model Context Protocol has emerged as the common language for that — a way for an AI assistant to discover and use the tools and data a business exposes. The implication for phone platforms is direct.
| If your call data is… | Then… |
|---|---|
| Locked in a vendor portal | It is invisible to any AI agent you deploy, and to any analysis you might want to run. It might as well not exist |
| Available through an open API, structured, with transcripts | It becomes one of the richest sources you have about what customers actually want — and it is reachable by the tools you are going to build next |
The quiet argument for openness
Your phone calls are the highest-quality customer research your business generates. People ring and tell you what they need, what confused them, and what your competitor quoted. A closed platform throws that away every day. An open one turns it into an asset that compounds — and the moment AI agents can reach it, the gap between those two positions stops being philosophical and starts being commercial.
To go further: 1,000+ integrations and open APIs covers the four connection methods and when to use each, Australian SaaS platforms and how each connects covers the specific software you are probably running, and AI transcription and CRM notes covers the data the transcript events produce.