> ## Documentation Index
> Fetch the complete documentation index at: https://docs.goyappr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create SIP Endpoint

> Create a new BYOC SIP endpoint. Returns a `sip_uri` that the customer
pastes into their own telephony platform — no authentication setup
required at the SIP layer. The slug (random 24-char suffix in the
URI) is the bearer credential.

Rate limit: 20 creates per company per day.


## BYOC SIP — bring your own telephony, no SIP setup

A SIP endpoint lets you route inbound calls from your own telephony platform
to a Yappr agent **without** buying a Yappr-managed phone number. Use it
when you already have a business line and want unanswered or escalated
calls to land on AI instead of voicemail.

On create, the server generates a high-entropy slug (a 1–12 char prefix
derived from your `name` + a hyphen + 24 random characters ≈ 120 bits of
entropy) and returns the full URI. The slug is the bearer credential — it's
the only thing protecting the endpoint from being dialed by strangers, so
treat the URI like an API key.

Hand the `sip_uri` to the customer. They paste it into their PBX or CPaaS
as the destination for the relevant route — no username or password, just
the URI string.

## Configuration on the customer's side

Three universal facts they'll need:

1. **URI** — the value of `sip_uri` from the response, e.g. `sip:after-hours-bz3r3mtypuwuw8tpdw3x392s@yappr-byoc.sip.telnyx.com`
2. **Authentication** — none
3. **Transport** — UDP/TCP/TLS all work; codecs G711/G722 supported

## Caller-ID trust

For calls arriving via SIP endpoints, the calling-party number comes from
whichever upstream system you point at us — and that upstream is under your
control. By default Yappr **does not** use that number for lead-memory
lookups or returning-caller recognition. If your upstream is trustworthy
(e.g. you operate it directly), you can opt an agent in via the dashboard.

## Optional: source-IP allowlist

Pass `allowed_source_ips` as a JSON array of CIDRs/IPs to restrict which
network sources can reach the endpoint. Useful when the customer's PBX
has a fixed egress IP. Omit (or pass `null`) to accept from any source.

## Rate limit

A company can create up to 20 SIP endpoints per day.

## Rotating access

There is no rotate-password endpoint — the slug itself is the secret. To
rotate, delete the endpoint (the URI immediately returns 404) and create a
new one with a fresh slug.


## OpenAPI

````yaml POST /sip-endpoints
openapi: 3.1.0
info:
  title: Yappr API
  description: >
    Create and manage AI voice agents, purchase phone numbers, configure tools,
    and initiate calls — all via REST.
  version: 1.0.0
  contact:
    url: https://goyappr.com
servers:
  - url: https://api.goyappr.com
    description: Production
security:
  - apiKey: []
paths:
  /sip-endpoints:
    post:
      tags:
        - SIP Endpoints
      summary: Create SIP endpoint
      description: |
        Create a new BYOC SIP endpoint. Returns a `sip_uri` that the customer
        pastes into their own telephony platform — no authentication setup
        required at the SIP layer. The slug (random 24-char suffix in the
        URI) is the bearer credential.

        Rate limit: 20 creates per company per day.
      operationId: createSipEndpoint
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - name
                - inbound_agent_id
              properties:
                name:
                  type: string
                  description: Human-readable label, shown in the dashboard.
                  example: After-hours
                inbound_agent_id:
                  type: string
                  format: uuid
                  description: Agent that should answer calls routed to this endpoint.
                slug:
                  type: string
                  description: |
                    Optional human-readable prefix (max 12 chars). Server
                    appends a hyphen and a 24-char random suffix to produce
                    the final slug. Lowercase letters/digits/single hyphens.
                    Auto-derived from `name` if omitted.
                  example: after-hours
                allowed_source_ips:
                  type: array
                  nullable: true
                  description: |
                    Optional list of CIDRs/IPs that may dial this endpoint.
                    `null` (default) accepts any source.
                  items:
                    type: string
                    example: 203.0.113.0/24
      responses:
        '201':
          description: SIP endpoint created. Hand the `sip_uri` to the customer.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/SipEndpoint'
        '400':
          description: Validation error (agent not found in this company, etc.).
        '409':
          description: Slug collision — retry to get a new random suffix.
        '429':
          description: Daily SIP endpoint creation limit reached.
components:
  schemas:
    SipEndpoint:
      type: object
      description: |
        A BYOC SIP endpoint. Customers paste the returned `sip_uri` into their
        own telephony system — calls dialed to that URI are routed to the
        Yappr agent identified by `inbound_agent_id`. No authentication is
        required at the SIP layer; the slug embedded in the URI is the
        bearer credential.

        Security model: the slug includes ~120 bits of entropy in its random
        suffix, so guessing is intractable. Treat the full URI like an API
        key — anyone with it can dial the agent. To revoke access, delete the
        endpoint (which makes the URI immediately return 404) and create a
        new one.

        Optional defense in depth: set `allowed_source_ips` to restrict which
        source IPs (or CIDRs) can reach the endpoint. Calls from any other
        source are rejected pre-answer.
      properties:
        id:
          type: string
          format: uuid
        name:
          type: string
          example: After-hours
        slug:
          type: string
          description: |
            SIP URI user-part. Server generates ~120 bits of entropy in a
            24-char random suffix, prefixed with a 1–12 char human-readable
            stub derived from `name` (or the `slug` value supplied in the
            request, if any). Example: `after-hours-bz3r3mtypuwuw8tpdw3x392s`.
          example: after-hours-bz3r3mtypuwuw8tpdw3x392s
        inbound_agent_id:
          type: string
          format: uuid
        is_active:
          type: boolean
        last_call_at:
          type: string
          format: date-time
          nullable: true
        allowed_source_ips:
          type: array
          nullable: true
          description: |
            Optional list of CIDRs / IPs allowed to dial this endpoint. `null`
            (default) accepts any source. Useful when the customer's PBX has
            a fixed egress IP.
          items:
            type: string
            example: 203.0.113.0/24
        sip_uri:
          type: string
          description: |
            Full SIP URI customers dial. This is what gets pasted into their
            telephony platform's outbound route — nothing else (no username,
            no password).
          example: sip:after-hours-bz3r3mtypuwuw8tpdw3x392s@yappr-byoc.sip.telnyx.com
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
  securitySchemes:
    apiKey:
      type: http
      scheme: bearer
      bearerFormat: API Key
      description: >-
        Your Yappr API key (e.g. `ypr_live_...`). Generate one in the dashboard
        under **Settings → API Keys**.

````