search

sipgate / sipgate.io

Create custom telephony integration solutions. Play audio files, manage your devices, reject the call, present dial tone menus or just create statistics. Adapt telephony to your business needs, control your home automation with your phone or just create that funny hack to make using the phone more enjoyable. @sipgate.io, https://twitter.com/sipgateio
https://www.sipgate.io
Other
202 stars 32 forks source link

Unauthorized API calls #141

Open DaSpors opened 4 years ago

DaSpors commented 4 years ago

We use the sipgate REST API to setup sipgate.io URLs for our application as documented here: https://api.sipgate.com/v2/doc#/settings/setSipgateIoUrls

Everythig is fine until the customer deletes his account on our side. We then drop all customer-related data but are still receiving calls from the sipgate.io system. Those calls are token-secured but the tokens do not exist anymore. The API-Calls are unauthenticated and we send a "403 Forbidden" header back, but this does not stop sipgate.io from polling on and on.

So feature request: React on some HTTP headers by stopping or allow an XML response to the "newCall" event that will make sipgate.io remove the URLs and stops calling our API.

Sample 1: Stop and remove config on sipgate.io side)

<?xml version="1.0" encoding="UTF-8"?>
<Response>
    <Unauthorized action="stop"/>
</Response>

Sample 2: Pause for some minutes/hours/days/calls

<?xml version="1.0" encoding="UTF-8"?>
<Response>
    <Unauthorized action="pause" value="1" unit="minute|hour|day|calls|..."/>
</Response>