> ## Documentation Index > Fetch the complete documentation index at: https://docs.wave.sa/llms.txt > Use this file to discover all available pages before exploring further. # Open a Web Calling session > Opens a browser calling session for the Wave Web Calling SDK and returns its SIP credentials. The SDK calls this for you. Two kinds of session: - **Agent session** — send an `identity` (a name you choose for the agent, for example `1001`). The browser registers as that identity, so a queue login or a callflow `` with the same name rings it. Wave creates the identity's SIP user on first use and gives it a new password for every session. Opening a new session for an identity ends the older one (the newest session wins). - **Caller session** — send no `identity`, for example for a website visitor who calls your business. The session can only call out. Wave gives it a temporary SIP user and deletes that user when the session ends. `identity` rules: 1–64 characters from `A–Z`, `a–z`, `0–9`, `.`, `_` and `-`. Identities that start with `p_` (portal members) or `c_` (caller sessions) are reserved. An identity that already names a SIP user Wave did not create (for example your desk phone) is refused with `409 IDENTITY_CONFLICT`. Sandbox keys ignore `identity` and always open a caller session. The request `Origin` must be in the project's allowed origins. Requires the `webrtc:write` scope. ## OpenAPI ````yaml /api-reference/openapi.json post /v1/webrtc/config openapi: 3.1.0 info: title: Wave API version: 1.0.0 description: >- Wave API Platform — voice, numbers, and messaging for Saudi Arabia. Request schemas are GENERATED from the @wave-sa/shared Zod schemas — do not edit by hand (run `pnpm --filter @wave-sa/api generate:openapi`). servers: - url: https://api.wave.sa security: - bearerAuth: [] paths: /v1/webrtc/config: post: tags: - Web Calling summary: Open a Web Calling session description: >- Opens a browser calling session for the Wave Web Calling SDK and returns its SIP credentials. The SDK calls this for you. Two kinds of session: - **Agent session** — send an `identity` (a name you choose for the agent, for example `1001`). The browser registers as that identity, so a queue login or a callflow `` with the same name rings it. Wave creates the identity's SIP user on first use and gives it a new password for every session. Opening a new session for an identity ends the older one (the newest session wins). - **Caller session** — send no `identity`, for example for a website visitor who calls your business. The session can only call out. Wave gives it a temporary SIP user and deletes that user when the session ends. `identity` rules: 1–64 characters from `A–Z`, `a–z`, `0–9`, `.`, `_` and `-`. Identities that start with `p_` (portal members) or `c_` (caller sessions) are reserved. An identity that already names a SIP user Wave did not create (for example your desk phone) is refused with `409 IDENTITY_CONFLICT`. Sandbox keys ignore `identity` and always open a caller session. The request `Origin` must be in the project's allowed origins. Requires the `webrtc:write` scope. operationId: createWebrtcSession requestBody: required: false content: application/json: schema: type: object properties: identity: type: string pattern: ^[A-Za-z0-9._-]{1,64}$ description: >- The web-calling identity for an agent session. Omit it for a caller session. example: '1001' responses: '200': description: The session was opened content: application/json: schema: $ref: '#/components/schemas/WebrtcSession' '400': description: >- The identity is badly formed or uses a reserved `p_` / `c_` prefix (INVALID_IDENTITY) content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: Missing or invalid API key content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: >- The Origin is not allowed (ORIGIN_NOT_ALLOWED), or the key cannot use Web Calling content: application/json: schema: $ref: '#/components/schemas/Error' '409': description: >- The identity names a SIP user Wave did not create (IDENTITY_CONFLICT) content: application/json: schema: $ref: '#/components/schemas/Error' '500': description: The media relay is misconfigured (TURN_UNAVAILABLE) content: application/json: schema: $ref: '#/components/schemas/Error' '502': description: >- The voice engine could not provision the session (WEBRTC_PROVISIONING_FAILED) content: application/json: schema: $ref: '#/components/schemas/Error' security: - bearerAuth: [] components: schemas: WebrtcSession: type: object properties: wcs: type: string description: >- The session token. Refresh it with `POST /v1/webrtc/config/refresh` before it expires. session_id: type: string format: uuid call_id: type: string format: uuid expires_at: type: string format: date-time expires_in_seconds: type: integer wss_url: type: string description: The SIP-over-WebSocket URL. sip_user: type: string description: The SIP user to register as (the identity, for an agent session). sip_password: type: string description: >- The SIP password for this session. Returned once; never stored in plain text. sip_domain: type: string ice_servers: type: array items: type: object session_type: type: string enum: - agent - caller description: >- `agent` — registered as a web-calling identity, can receive calls. `caller` — can only call out. identity: type: string description: The identity of an agent session. Absent for a caller session. required: - wcs - session_id - call_id - expires_at - expires_in_seconds - wss_url - sip_user - sip_password - sip_domain - ice_servers - session_type Error: type: object description: Wave's standard bilingual error envelope. required: - error_code - message - message_ar - request_id - docs_url properties: error_code: type: string enum: - INVALID_API_KEY - EXPIRED_API_KEY - REVOKED_API_KEY - SANDBOX_KEY_NOT_ALLOWED - INSUFFICIENT_PERMISSIONS - API_KEY_REVEAL_UNAVAILABLE - RATE_LIMIT_EXCEEDED - RECAPTCHA_FAILED - SANDBOX_EXPIRED - OTP_INVALID - OTP_EXPIRED - OTP_TOO_MANY_ATTEMPTS - OTP_RESEND_TOO_SOON - OTP_SEND_FAILED - INVALID_PHONE_NUMBER - CALLBACK_NOT_FOUND - CALLBACK_ALREADY_CANCELLED - CALLBACK_NOT_CANCELLABLE - CALL_NOT_FOUND - CALL_FAILED - INSUFFICIENT_CREDITS - CALL_NOT_CONTROLLABLE - CALL_NOT_ACTIVE - CALL_NOT_ANSWERED - CALL_CONTROL_FAILED - CALL_CONTROL_UNSUPPORTED - CALL_CONTROL_DISABLED - INVALID_PLAY_URL - QUEUE_CONTROL_FAILED - QUEUE_SERVICE_UNAVAILABLE - RECORDING_NOT_FOUND - RECORDING_URL_EXPIRED - RECORDING_SERVICE_UNAVAILABLE - CALLFLOW_AUDIO_SERVICE_UNAVAILABLE - VOICE_AUTH_DISABLED - VOICE_AUTH_NOT_FOUND - VOICE_AUTH_ASSURANCE_UNSUPPORTED - VOICE_AUTH_RATE_LIMITED - VOICE_AUTH_BLOCKED - VERIFY_DISABLED - VERIFY_NOT_FOUND - VERIFY_INVALID_CODE - VERIFY_MAX_ATTEMPTS - VERIFY_EXPIRED - VERIFY_RATE_LIMITED - VERIFY_SEND_FAILED - VERIFY_BLOCKED - VOICEMAIL_DISABLED - VOICEMAIL_NOT_FOUND - VOICEMAIL_RECORDING_NOT_FOUND - VOICEMAIL_SERVICE_UNAVAILABLE - VOICEMAIL_GREETING_INVALID - DLQ_REPLAY_DISABLED - DLQ_REPLAY_BROKER_UNAVAILABLE - MESSAGES_DISABLED - IVR_DISABLED - SANDBOX_INVALID_QUEUE - SANDBOX_QUEUE_UNAVAILABLE - SANDBOX_SIMULATED_SERVER_ERROR - SANDBOX_DESTINATION_NOT_ALLOWED - SANDBOX_MINUTES_EXCEEDED - WIDGET_ORIGIN_NOT_ALLOWED - PROJECT_NOT_FOUND - WEBHOOK_URL_INVALID - WEBHOOK_UNREACHABLE - WEBHOOK_LIMIT_EXCEEDED - WEBHOOK_URL_DUPLICATE - WEBHOOK_NOT_FOUND - WEBHOOK_VERIFICATION_FAILED - SIGNUP_EMAIL_TAKEN - SIGNUP_VALIDATION_FAILED - VITALPBX_PROVISIONING_FAILED - SIGNUP_FAILED - API_KEY_NOT_FOUND - API_KEY_REVEAL_FORBIDDEN - PRODUCTION_ACCESS_ALREADY_REQUESTED - PRODUCTION_TIER_REQUIRED - PRODUCTION_REQUEST_EXISTS - PRODUCTION_REQUEST_NOT_FOUND - PRODUCTION_REQUEST_INVALID_STATE - VALIDATION_ERROR - INTERNAL_ERROR - NOT_FOUND - PAYLOAD_TOO_LARGE - IDEMPOTENCY_KEY_CONFLICT - INVALID_CREDENTIALS - SESSION_REQUIRED - INVALID_ACCESS_TOKEN - EXPIRED_ACCESS_TOKEN - INVALID_REFRESH_TOKEN - EXPIRED_REFRESH_TOKEN - REFRESH_REUSE_DETECTED - REFRESH_ROTATION_RACE - SESSION_IDLE_TIMEOUT - WEB_CALLING_DISABLED - ORIGIN_NOT_ALLOWED - WEBRTC_CONCURRENCY_LIMIT - WCS_NOT_FOUND - WCS_EXPIRED - WCS_REVOKED - WCS_REUSE_DETECTED - WCS_NOT_ALLOWED_AS_BEARER - WEBRTC_PROVISIONING_FAILED - TURN_UNAVAILABLE - INVALID_IDENTITY - IDENTITY_CONFLICT - PROFILE_VALIDATION_FAILED - PASSWORD_VALIDATION_FAILED - INVALID_CURRENT_PASSWORD - PASSWORD_SSO_ONLY - SETUP_ALREADY_COMPLETE - INVALID_NATIONAL_ID - NAFATH_INITIATE_FAILED - NAFATH_NOT_VERIFIED - NAFATH_REJECTED - NAFATH_EXPIRED - NAFATH_ALREADY_REGISTERED - NAFATH_INVALID_WEBHOOK - NAFATH_ALREADY_VERIFIED - NAFATH_REQUIRED - ADMIN_UNAUTHORIZED - ADMIN_INVALID_CREDENTIALS - ADMIN_ORG_OWNER_EMAIL_TAKEN - ADMIN_USER_NOT_FOUND - INSUFFICIENT_ROLE - LAST_OWNER - INVALID_SCOPE - NUMBER_NOT_AVAILABLE - NUMBER_NOT_FOUND - NUMBER_ALREADY_ASSIGNED - NUMBER_PROVIDER_ERROR - PORTING_INVALID_STATE - PORTING_NOT_FOUND - OWN_DID_NUMBER_REQUIRED - OWN_DID_NUMBER_NOT_AUTHORIZED - OWN_DID_NUMBER_UNAVAILABLE - SPEND_CAP_EXCEEDED - RATE_PLAN_NOT_FOUND - PAYMENT_FAILED - DUPLICATE_USAGE_EVENT - INVOICE_NOT_FOUND - ENGINE_UNAUTHORIZED - CALLFLOW_TENANT_NOT_FOUND - CLI_NOT_OWNED - WEBHOOK_UNAUTHORIZED - CHANNEL_NOT_CONFIGURED - WEBHOOK_PAYLOAD_INVALID - INVITE_NOT_FOUND - INVITE_NOT_PENDING - INVITE_EXPIRED - INVITE_ROLE_INVALID - INVITE_ALREADY_MEMBER - INVITE_EMAIL_OTHER_ORG - INVITE_ACCOUNT_DETAILS_REQUIRED message: type: string description: English message. message_ar: type: string description: Arabic message. request_id: type: string docs_url: type: string format: uri securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: sk_sandbox_* | sk_live_* description: >- Your API key from the Wave dashboard. Sandbox keys start `sk_sandbox_`; production keys start `sk_live_`. Send as `Authorization: Bearer `. Some endpoints require a production key and specific scopes. ````