Jelliu API documentation

Moves a live call into a conference and dials transfer_to, so a human joins the caller. Finish with POST /api/calls/{callId}/transfer/complete (the human keeps the caller) or POST /api/calls/{callId}/transfer/cancel (hang up the human and hand the caller back to the AI).

Checks, in order: the destination must pass the workspace’s destination policy (premium-rate / toll-fraud prefixes, workspace blocklist, allowed countries; refused with 403 even before the call is looked up, and the refusal is written to the audit log with the masked number); the call must exist; it must have a carrier leg, so calls on a SIP-trunk number cannot be transferred (400); and the carrier must confirm the leg is in-progress (400 when not, 409 when the carrier cannot be reached).

Side effects. Redirects the caller’s leg into a conference (the AI stops speaking at that moment) and places a second, billable outbound call to transfer_to from the workspace’s own voice number. Stores transfer_call_sid, transferred_at and transferred_to on the call. Writes an audit entry.

Idempotency. Not idempotent: each successful request dials transfer_to again into a new conference.

Access

Required scope: full. Signed-in users need the admin or owner role.
Rate limit: Outbound — 20 requests/min per workspace, and also the General API budget (per plan: 120 to 600 requests/min per workspace). See Rate limits.
Plan: Available on every plan.

Moves a live call into a conference and dials `transfer_to`, so a human joins the caller. Finish with `POST /api/calls/{callId}/transfer/complete` (the human keeps the caller) or `POST /api/calls/{callId}/transfer/cancel` (hang up the human and hand the caller back to the AI). Checks, in order: the destination must pass the workspace's destination policy (premium-rate / toll-fraud prefixes, workspace blocklist, allowed countries; refused with 403 even before the call is looked up, and the refusal is written to the audit log with the masked number); the call must exist; it must have a carrier leg, so calls on a SIP-trunk number cannot be transferred (400); and the carrier must confirm the leg is `in-progress` (400 when not, 409 when the carrier cannot be reached). **Side effects.** Redirects the caller's leg into a conference (the AI stops speaking at that moment) and places a second, billable outbound call to `transfer_to` from the workspace's own voice number. Stores `transfer_call_sid`, `transferred_at` and `transferred_to` on the call. Writes an audit entry. **Idempotency.** Not idempotent: each successful request dials `transfer_to` again into a new conference. **Access** - **Required scope:** `full`. Signed-in users need the admin or owner role. - **Rate limit:** Outbound — 20 requests/min per workspace, and also the General API budget (per plan: 120 to 600 requests/min per workspace). See [Rate limits](/rate-limits). - **Plan:** Available on every plan.

Authentication

AuthorizationBearer

Workspace API key: jl_ followed by 64 lowercase hex characters, created by the workspace owner in the dashboard (Settings → API Keys) and sent as Authorization: Bearer jl_.... The plaintext is shown once, at creation; Jelliu stores only a SHA-256 hash. A workspace can hold up to 25 active keys.

Scope	GET / HEAD	POST / PUT / PATCH / DELETE	Admin-only routes
`read`	Yes	No	No
`write`	Yes	Yes	No
`full`	Yes	Yes	Yes

Operations restricted to admins or owners reject keys without the full scope with 403, and say so in their description. No key, whatever its scope, can mint or revoke API keys or rotate a webhook secret — that requires a signed-in owner session. A revoked key stops authenticating within about 10 seconds. See Authentication.

Workspace API key: `jl_` followed by 64 lowercase hex characters, created by the workspace owner in the dashboard (**Settings → API Keys**) and sent as `Authorization: Bearer jl_...`. The plaintext is shown once, at creation; Jelliu stores only a SHA-256 hash. A workspace can hold up to 25 active keys. | Scope | GET / HEAD | POST / PUT / PATCH / DELETE | Admin-only routes | | --- | --- | --- | --- | | `read` | Yes | No | No | | `write` | Yes | Yes | No | | `full` | Yes | Yes | Yes | Operations restricted to admins or owners reject keys without the `full` scope with `403`, and say so in their description. No key, whatever its scope, can mint or revoke API keys or rotate a webhook secret — that requires a signed-in owner session. A revoked key stops authenticating within about 10 seconds. See [Authentication](/authentication).

Path parameters

callIdstringRequiredformat: "uuid"

The live call’s id. Must be a UUID (400 Invalid call ID otherwise).

Request

This endpoint expects an object.

transfer_tostringRequiredformat: "^\+[1-9]\d{1,14}$"

E.164 number of the human to transfer to. Must also be allowed by the workspace's destination policy.

Response

The caller is in the conference and the human leg is being dialed.

dataobject

Errors

400

Bad Request Error

401

Unauthorized Error

403

Forbidden Error

404

Not Found Error

409

Conflict Error

429

Too Many Requests Error

502

Bad Gateway Error

Idempotency. Not idempotent: each successful request dials transfer_to again into a new conference.

Access

Required scope: full. Signed-in users need the admin or owner role.
Rate limit: Outbound — 20 requests/min per workspace, and also the General API budget (per plan: 120 to 600 requests/min per workspace). See Rate limits.
Plan: Available on every plan.