Connect the agent's browser to this call's audio

POST 
/api/calls/:callId/webrtc

The call-id keyed form of the conversation softphone leg. connectAgent REPLACES the bridge's agent peer, so it must land on the intended call: aimed at the wrong leg it takes the agent's microphone off the conversation they are having.

Only the agent who holds the call may connect it.

LEGS AND EPOCHS (SES-1 F4). Against a bridge advertising the leg_epoch feature EVERY connect takes the fenced path: the SERVER allocates a monotonic epoch for the call and the bridge refuses anything lower or equal with leg_superseded. This is what stops a client waking from doze and retrying a stale connect from silently seizing a call that has since moved to another device — and a refusal there means NOTHING is written here.

Naming a device_id is what lets the leg be ATTRIBUTED, not what makes it fenced. A caller that omits it is fenced exactly the same way and gets a leg with no device bound — otherwise the oldest builds in the fleet would be the only ones able to seize a live leg, which is the one power the fence exists to remove.

The epoch is never accepted from the client. A caller that could choose its own generation could outrank a live leg simply by picking a large number, which is the very attack the fence exists to stop.

MAKE-BEFORE-BREAK runs on both sides. The client half this endpoint depends on and cannot enforce: the browser must already hold a real microphone track before it POSTs, so a takeover that dies at the permission prompt never took anything. The server half: a 200 records the leg as connecting only — the previous device keeps carrying the call until the bridge reports leg_connected, and a leg that never connects (leg_failed) leaves the live one entirely undisturbed.

On a bridge without leg_epoch the behaviour is exactly what it was before F4: the agent peer is replaced, and no leg is recorded. A bridge that cannot fence must not be handed a number it will ignore.

Request

Responses

200

The sidecar's SDP answer, for the browser to complete its leg.

401

Not authenticated. code: account_disabled means the member's seat was deactivated in this workspace: the session is over even though the token was not revoked (clients sign out and clean up).

403

The call is held by another agent.

404

Resource not found (or not visible to the current tenant).

409

Either the call is no longer in flight (its final state is returned), or — code: leg_superseded — a NEWER leg holds the audio, or — code: consult_superseded — this agent joined the same consultation from ANOTHER device while this offer was at the bridge. In every case nothing was written and nothing moved: the client must tear down the media it built rather than publish it, and active_leg says where the audio actually is.

422

The sidecar refused the offer.