CRM API keys - CX Bridge

Purpose

CRM API keys allow external systems to trigger outbound calls without an admin JWT. Endpoint:

POST /api/v1/sip/dialout
X-API-Key: vx_...
Content-Type: application/json

In CXB Console:

The full key is shown only once. After that only the masked prefix is visible.

Keys use:

vx_ + 32 random characters

CXB API stores only a SHA-256 hash in MongoDB.

Each key is checked on every authenticated request:

Control	Behavior
Active toggle (`is_active`)	An inactive key is rejected at auth. Deactivate instead of deleting to keep an audit trail.
Expiry (`expires_at`)	Optional. When set and in the past, the key is rejected. Leave unset for a non-expiring key.

Set an expiry when handing a key to a short-lived integration or pilot. Deactivate (or let it expire) to revoke access without rotating other keys.

CRM-friendly payload:

{
  "bot_id": "bot-id-here",
  "to_number": "+919999999999",
  "variables": {
    "CUSTOMERNAME": "Rajesh",
    "due_amount": "50000"
  }
}

variables is an alias for connected_event. Do not send both in the same request.