⚡ Quick answer -

1. Generate an API token in Dashboard → APIs & Webhook.
2. Respect Pull-API limits: 20 req/min, 100 req/hr, 500 req/day (APIs unavailable on Lite plans).
3. Choose Pull (your app requests data) or Push (MyOperator sends webhooks to you).
4. Secure every request with Authorization: Bearer <TOKEN>; rotate keys and store them in a secrets manager.
5. On errors:
1.  401/403 → check token/scope 
2. 429 → wait Retry-After 
3. 5xx/timeout → exponential back-off + idempotency key.
6. If the API is down, serve cached reads + queue writes for replay, switch agents to manual dialing, and reconcile once the first healthy 2xx appears.

When should I use this guide?

Use it when you need a single, canonical reference for:

• enabling API access,

• understanding rate limits,

• deciding between Push and Pull, and

• handling errors or complete service outages.

1. What do we mean by “API”?

2. Prerequisites

• Plan with API access (not Lite)

• Role permission to view Developer/API settings

• Generated API key/token

• Outbound network allowed (if your org uses IP allow-lists or CORS)

3. API types: Push vs Pull

4. Authentication & base URL

1. Go to Dashboard → APIs & Webhook → Calling APIs → API token → Generate.
2. Store the token in a secrets manager; never embed it in client-side code.
3. Base-URL pattern: https://api.<region>.myoperator.example
4. Add the header to every request: Authorisation: Bearer <YOUR_API_KEY>

5. Rate limits & fair-usage policy

Notes:

• Exceeding any limit returns 429 Too Many Requests—back off and honor Retry-After.

• APIs are not available on Lite packages.

6. Quick-start examples

Replace placeholders like <BASE_URL>, <TOKEN>, <AGENT_ID>.

a) Ping

curl -H "Authorization: Bearer "
-H "Accept: application/json"
"<BASE_URL>/v1/ping"

b) Click-to-Call (write)

curl -X POST "<BASE_URL>/v1/click-to-call"
-H "Authorization: Bearer "
-H "Content-Type: application/json"
-d '{
"from": "<FROM_NUMBER>",
"to": "<TO_NUMBER>",
"agentId": "<AGENT_ID>",
"metadata": { "source": "CRM", "leadId": "L-93821" }
}'

c) Call Logs (read)

curl "<BASE_URL>/v1/call-logs?from=2025-08-01T00:00:00Z&to=2025-08-23T23:59:59Z&direction=inbound&limit=50"
-H "Authorization: Bearer "

d) Recording link (expires in 24 h)

curl "<BASE_URL>/v1/recordings/<CALL_ID>"
-H "Authorization: Bearer "

7. What if the API is unavailable?

Immediate steps

1. Run one read and one write call; if both return 5xx/timeout, confirm provider outage.
2. Push failed writes to a durable queue.
3. Serve cached or “last-known” data for reads.
4. Switch agents to manual dialing or the Web Panel.

Recovery checklist

• Wait for first healthy 2xx read + write.

• Drain queued writes (idempotency prevents duplicates).

• Reconcile call counts, recordings, and user sync for the outage window.

• Document start/end times and codes; then close the incident.

8. Security, PII & best practices

• Keep keys in a secrets manager; never commit to source control.

• Use least-privilege scoped tokens; rotate regularly.

• Prefer webhooks over aggressive polling for near-real-time needs.

• Follow your org’s data-retention policy for recordings and phone numbers.

9. Troubleshooting status codes

Keywords: MyOperator API, pull API limits, push API, API outage handling, click-to-call, rate limit 429, idempotency key