Your own AI as the assistant

# Your own-AI assistants (create them in the app: Settings → AI assistants → NEW → "Your own AI")
curl https://api.meiti.ai/v1/agents -H "X-Api-Key: $MEITI_API_KEY"

# Point one at your endpoints. Omitted fields stay as they are; "" disconnects a channel.
curl -X PATCH https://api.meiti.ai/v1/agents/812 \
  -H "X-Api-Key: $MEITI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "chatUrl": "https://ai.example.com/meiti/chat",
    "voiceUrl": "wss://ai.example.com/meiti/voice",
    "timeoutSeconds": 10
  }'

# Signing secret: the response { "secret": "whsec_…" } is the only time you can read it.
curl -X POST https://api.meiti.ai/v1/agents/812/secret -H "X-Api-Key: $MEITI_API_KEY"

# Signed "ping" to chatUrl, then one WebSocket connect to voiceUrl.
curl -X POST https://api.meiti.ai/v1/agents/812/test -H "X-Api-Key: $MEITI_API_KEY"
# 200: { success, statusCode, durationMs, error }

const meiti = (path, method = "GET", body) =>
  fetch(`https://api.meiti.ai${path}`, {
    method,
    headers: { "X-Api-Key": process.env.MEITI_API_KEY, "Content-Type": "application/json" },
    body: body && JSON.stringify(body),
  }).then(r => r.json());

const [agent] = await meiti("/v1/agents"); // created in the app as "Your own AI"
await meiti(`/v1/agents/${agent.agentId}`, "PATCH", {
  chatUrl: "https://ai.example.com/meiti/chat",
  voiceUrl: "wss://ai.example.com/meiti/voice", // "" disconnects a channel
  timeoutSeconds: 10,
});
const { secret } = await meiti(`/v1/agents/${agent.agentId}/secret`, "POST"); // shown exactly once
const test = await meiti(`/v1/agents/${agent.agentId}/test`, "POST"); // { success, statusCode, durationMs, error }

import os, requests

api = requests.Session()
api.headers["X-Api-Key"] = os.environ["MEITI_API_KEY"]
base = "https://api.meiti.ai/v1"

agent = api.get(f"{base}/agents").json()[0]  # created in the app as "Your own AI"
api.patch(f"{base}/agents/{agent['agentId']}", json={
    "chatUrl": "https://ai.example.com/meiti/chat",
    "voiceUrl": "wss://ai.example.com/meiti/voice",  # "" disconnects a channel
    "timeoutSeconds": 10,
})
secret = api.post(f"{base}/agents/{agent['agentId']}/secret").json()["secret"]  # shown exactly once
test = api.post(f"{base}/agents/{agent['agentId']}/test").json()  # success, statusCode, durationMs, error

// call() from the quickstart. GET /v1/agents answers with a JSON array; read the id from the app or decode it yourself.
id := "812" // agentId of your "Your own AI" assistant
_, status, err := call("PATCH", "/v1/agents/"+id, map[string]any{
	"chatUrl":        "https://ai.example.com/meiti/chat",
	"voiceUrl":       "wss://ai.example.com/meiti/voice", // "" disconnects a channel
	"timeoutSeconds": 10,
})
if err != nil || status != 200 {
	log.Fatal(status, err)
}
created, _, _ := call("POST", "/v1/agents/"+id+"/secret", nil)
saveSecret(created["secret"].(string)) // shown exactly once
test, _, _ := call("POST", "/v1/agents/"+id+"/test", nil)
fmt.Println(test["success"], test["durationMs"], test["error"])

// http from the quickstart (BaseAddress + X-Api-Key)
var agents = await http.GetFromJsonAsync<JsonElement>("v1/agents"); // created in the app as "Your own AI"
var id = agents[0].GetProperty("agentId").GetInt32();

await http.PatchAsJsonAsync($"v1/agents/{id}", new
{
    chatUrl = "https://ai.example.com/meiti/chat",
    voiceUrl = "wss://ai.example.com/meiti/voice", // "" disconnects a channel
    timeoutSeconds = 10,
});
var created = await (await http.PostAsync($"v1/agents/{id}/secret", null)).Content.ReadFromJsonAsync<JsonElement>();
var secret = created.GetProperty("secret").GetString(); // shown exactly once
var test = await (await http.PostAsync($"v1/agents/{id}/test", null)).Content.ReadFromJsonAsync<JsonElement>();

<?php
function meiti(string $method, string $path, ?array $body = null): array {
    $ch = curl_init("https://api.meiti.ai" . $path);
    $options = [
        CURLOPT_CUSTOMREQUEST => $method,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER => ["X-Api-Key: " . getenv("MEITI_API_KEY"), "Content-Type: application/json"],
    ];
    if ($method !== "GET") {
        $options[CURLOPT_POSTFIELDS] = $body === null ? "" : json_encode($body);
    }
    curl_setopt_array($ch, $options);
    return json_decode(curl_exec($ch), true);
}

$id = meiti("GET", "/v1/agents")[0]["agentId"]; // created in the app as "Your own AI"
meiti("PATCH", "/v1/agents/$id", [
    "chatUrl" => "https://ai.example.com/meiti/chat",
    "voiceUrl" => "wss://ai.example.com/meiti/voice", // "" disconnects a channel
    "timeoutSeconds" => 10,
]);
$secret = meiti("POST", "/v1/agents/$id/secret")["secret"]; // shown exactly once
$test = meiti("POST", "/v1/agents/$id/test"); // success, statusCode, durationMs, error

// Node + Express. myAI stands for your own model, prompt and data.
import crypto from "node:crypto";
import express from "express";

const app = express();
const secret = process.env.MEITI_AGENT_SECRET; // from "Create secret" or POST /v1/agents/{id}/secret

// X-Meiti-Signature: t=<unix>,v1=<hex HMAC-SHA256(secret, t + "." + signed)>
function verify(header, signed) {
  const sig = Object.fromEntries((header ?? "").split(",").map(p => p.split("=")));
  const expected = crypto.createHmac("sha256", secret).update(`${sig.t}.${signed}`).digest("hex");
  const fresh = Math.abs(Date.now() / 1000 - Number(sig.t)) < 300;
  return fresh && sig.v1?.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(sig.v1), Buffer.from(expected));
}

// Raw body: the signature covers the exact bytes meiti sent.
app.post("/meiti/chat", express.raw({ type: "application/json" }), async (req, res) => {
  if (!verify(req.get("X-Meiti-Signature"), req.body)) return res.sendStatus(401);
  const event = JSON.parse(req.body);
  if (event.type !== "message.received") return res.sendStatus(200); // "ping" from the connection test
  if (event.data.autoReply.state !== "on") return res.sendStatus(204); // your team has it — stay quiet (or answer anyway)

  const { message, history, contact } = event.data;
  const answer = await myAI({ text: message.text, history, contact }); // within timeoutSeconds

  res.json({
    text: answer.text,
    action: answer.needsPerson ? "handover" : "none", // handover: your team takes over in the inbox
    note: answer.needsPerson ? answer.reason : undefined, // only your team sees it
  });
});

app.listen(3000);

# Python + Flask. my_ai stands for your own model, prompt and data.
import hashlib, hmac, json, os, time
from flask import Flask, abort, request

app = Flask(__name__)
SECRET = os.environ["MEITI_AGENT_SECRET"].encode()  # from "Create secret" or POST /v1/agents/{id}/secret

# X-Meiti-Signature: t=<unix>,v1=<hex HMAC-SHA256(secret, t + "." + signed)>
def verify(header: str, signed: bytes) -> bool:
    sig = dict(p.split("=", 1) for p in header.split(",") if "=" in p)
    t, v1 = sig.get("t", ""), sig.get("v1", "")
    expected = hmac.new(SECRET, t.encode() + b"." + signed, hashlib.sha256).hexdigest()
    return t.isdigit() and abs(time.time() - int(t)) <= 300 and hmac.compare_digest(v1, expected)

@app.post("/meiti/chat")
def meiti_chat():
    body = request.get_data()  # the exact bytes meiti signed
    if not verify(request.headers.get("X-Meiti-Signature", ""), body):
        abort(401)
    event = json.loads(body)
    if event["type"] != "message.received":
        return "", 200  # "ping" from the connection test

    data = event["data"]
    if data["autoReply"]["state"] != "on":
        return "", 204  # your team has it — stay quiet (or answer anyway)
    answer = my_ai(text=data["message"]["text"], history=data["history"], contact=data.get("contact"))
    reply = {"text": answer.text, "action": "handover" if answer.needs_person else "none"}
    if answer.needs_person:
        reply["note"] = answer.reason  # only your team sees it
    return reply

// net/http. myAI stands for your own model, prompt and data.
package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"io"
	"net/http"
	"os"
	"strconv"
	"strings"
	"time"
)

// verify checks X-Meiti-Signature: t=<unix>,v1=<hex HMAC-SHA256(secret, t + "." + signed)>.
func verify(header string, signed []byte) bool {
	var t, v1 string
	for _, part := range strings.Split(header, ",") {
		k, v, _ := strings.Cut(part, "=")
		switch k {
		case "t":
			t = v
		case "v1":
			v1 = v
		}
	}
	unix, err := strconv.ParseInt(t, 10, 64)
	mac := hmac.New(sha256.New, []byte(os.Getenv("MEITI_AGENT_SECRET")))
	mac.Write([]byte(t + "."))
	mac.Write(signed)
	expected := hex.EncodeToString(mac.Sum(nil))
	age := time.Since(time.Unix(unix, 0))
	return err == nil && age <= 5*time.Minute && age >= -5*time.Minute && hmac.Equal([]byte(expected), []byte(v1))
}

type turn struct {
	Role string `json:"role"`
	Text string `json:"text"`
}

func meitiChat(w http.ResponseWriter, r *http.Request) {
	body, _ := io.ReadAll(r.Body) // the exact bytes meiti signed
	if !verify(r.Header.Get("X-Meiti-Signature"), body) {
		w.WriteHeader(http.StatusUnauthorized)
		return
	}
	var event struct {
		Type string `json:"type"`
		Data struct {
			Message struct {
				Text string `json:"text"`
			} `json:"message"`
			History  []turn `json:"history"`
			ReplyURL string `json:"replyUrl"`
			AutoReply struct {
				State string `json:"state"`
			} `json:"autoReply"`
		} `json:"data"`
	}
	if err := json.Unmarshal(body, &event); err != nil {
		w.WriteHeader(http.StatusBadRequest)
		return
	}
	if event.Type != "message.received" {
		w.WriteHeader(http.StatusOK) // "ping" from the connection test
		return
	}
	if event.Data.AutoReply.State != "on" {
		w.WriteHeader(http.StatusNoContent) // your team has it — stay quiet (or answer anyway)
		return
	}

	answer := myAI(event.Data.Message.Text, event.Data.History)
	reply := map[string]any{"text": answer.Text, "action": "none"}
	if answer.NeedsPerson {
		reply["action"] = "handover" // your team takes over in the inbox
		reply["note"] = answer.Reason // only your team sees it
	}
	w.Header().Set("Content-Type", "application/json")
	_ = json.NewEncoder(w).Encode(reply)
}

func main() {
	http.HandleFunc("POST /meiti/chat", meitiChat)
	http.ListenAndServe(":3000", nil)
}

// ASP.NET Core minimal API (works from .NET 8 on). MyAI stands for your own model, prompt and data.
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;

var app = WebApplication.CreateBuilder(args).Build();
var secret = Encoding.UTF8.GetBytes(Environment.GetEnvironmentVariable("MEITI_AGENT_SECRET")!);

// X-Meiti-Signature: t=<unix>,v1=<hex HMAC-SHA256(secret, t + "." + signed)>
bool Verify(string header, byte[] signed)
{
    var sig = header.Split(',').Select(p => p.Split('=', 2)).Where(p => p.Length == 2).ToDictionary(p => p[0], p => p[1]);
    if (!sig.TryGetValue("t", out var t) || !long.TryParse(t, out var unix) || !sig.TryGetValue("v1", out var v1)
        || Math.Abs(DateTimeOffset.UtcNow.ToUnixTimeSeconds() - unix) > 300)
        return false;
    var expected = Convert.ToHexString(HMACSHA256.HashData(secret, Encoding.UTF8.GetBytes(t + ".").Concat(signed).ToArray())).ToLowerInvariant();
    return CryptographicOperations.FixedTimeEquals(Encoding.ASCII.GetBytes(expected), Encoding.ASCII.GetBytes(v1));
}

app.MapPost("/meiti/chat", async (HttpRequest request) =>
{
    using var buffer = new MemoryStream();
    await request.Body.CopyToAsync(buffer);
    var body = buffer.ToArray(); // the exact bytes meiti signed
    if (!Verify(request.Headers["X-Meiti-Signature"].ToString(), body))
        return Results.Unauthorized();

    using var evt = JsonDocument.Parse(body);
    if (evt.RootElement.GetProperty("type").GetString() != "message.received")
        return Results.Ok(); // "ping" from the connection test

    var data = evt.RootElement.GetProperty("data");
    if (data.GetProperty("autoReply").GetProperty("state").GetString() != "on")
        return Results.NoContent(); // your team has it — stay quiet (or answer anyway)

    var answer = await MyAI.AnswerAsync(data.GetProperty("message").GetProperty("text").GetString(), data.GetProperty("history"));
    return Results.Ok(new
    {
        text = answer.Text,
        action = answer.NeedsPerson ? "handover" : "none", // handover: your team takes over in the inbox
        note = answer.NeedsPerson ? answer.Reason : null,   // only your team sees it
    });
});

app.Run();

<?php
// meiti-chat.php. myAi() stands for your own model, prompt and data.
$body = file_get_contents("php://input"); // the exact bytes meiti signed
parse_str(str_replace(",", "&", $_SERVER["HTTP_X_MEITI_SIGNATURE"] ?? ""), $sig);
$t = $sig["t"] ?? "";
$expected = hash_hmac("sha256", $t . "." . $body, getenv("MEITI_AGENT_SECRET"));
if (!ctype_digit($t) || abs(time() - (int)$t) > 300 || !hash_equals($expected, $sig["v1"] ?? "")) {
    http_response_code(401);
    exit;
}

$event = json_decode($body, true);
if ($event["type"] !== "message.received") { http_response_code(200); exit; } // "ping" from the connection test

$data = $event["data"];
if ($data["autoReply"]["state"] !== "on") { http_response_code(204); exit; } // your team has it — stay quiet (or answer anyway)

$answer = myAi($data["message"]["text"], $data["history"], $data["contact"] ?? null);
header("Content-Type: application/json");
echo json_encode([
    "text" => $answer["text"],
    "action" => $answer["needsPerson"] ? "handover" : "none", // handover: your team takes over in the inbox
    "note" => $answer["needsPerson"] ? $answer["reason"] : null, // only your team sees it
]);

# Your endpoint answered 202 (or 204). Later, with an API key of the same inbox:
curl https://api.meiti.ai/v1/projects/67890/agent-replies \
  -H "X-Api-Key: $MEITI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "text": "Ihre neue Lieferadresse ist eingetragen.", "action": "none" }'
# 202: { "projectId": 67890, "messageId": 991262, "status": "sent", "autoReply": { "state": "on" } }
# "autoReply.state" other than "on" = your team took over in the meantime; the text went out anyway.
# 409 project_not_with_agent: no own-AI assistant answers this project — drop the answer.

app.post("/meiti/chat", express.raw({ type: "application/json" }), (req, res) => {
  if (!verify(req.get("X-Meiti-Signature"), req.body)) return res.sendStatus(401);
  const event = JSON.parse(req.body);
  res.sendStatus(202); // answer right away …
  if (event.type !== "message.received" || event.data.autoReply.state !== "on") return; // your team has it

  myAI(event.data).then(async answer => { // … and reply when your AI is done
    const r = await fetch(event.data.replyUrl, {
      method: "POST",
      headers: { "X-Api-Key": process.env.MEITI_API_KEY, "Content-Type": "application/json" },
      body: JSON.stringify({ text: answer.text, action: "none" }),
    });
    const accepted = r.status === 202 ? await r.json() : null;
    if (accepted && accepted.autoReply.state !== "on") console.log("your team took over meanwhile — the answer went out anyway");
  });
});

import threading, requests

@app.post("/meiti/chat")
def meiti_chat():
    body = request.get_data()
    if not verify(request.headers.get("X-Meiti-Signature", ""), body):
        abort(401)
    event = json.loads(body)
    if event["type"] == "message.received" and event["data"]["autoReply"]["state"] == "on":
        def later():
            answer = my_ai(event["data"])  # takes as long as it takes
            res = requests.post(
                event["data"]["replyUrl"],
                headers={"X-Api-Key": os.environ["MEITI_API_KEY"]},
                json={"text": answer.text, "action": "none"},
                timeout=10,
            )
            if res.status_code == 202 and res.json()["autoReply"]["state"] != "on":
                print("your team took over meanwhile — the answer went out anyway")
        threading.Thread(target=later).start()
    return "", 202  # answer right away

// In meitiChat above, instead of the direct reply (add "bytes" to its imports):
w.WriteHeader(http.StatusAccepted) // answer right away …
go func(replyURL, text string) {   // … and reply when your AI is done
	answer := myAI(text, nil)
	b, _ := json.Marshal(map[string]any{"text": answer.Text, "action": "none"})
	req, _ := http.NewRequest("POST", replyURL, bytes.NewReader(b))
	req.Header.Set("X-Api-Key", os.Getenv("MEITI_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	res, err := http.DefaultClient.Do(req)
	if err == nil {
		res.Body.Close() // 202 with "autoReply": { "state": "off" } = your team took over meanwhile, the text went out anyway
	}
}(event.Data.ReplyURL, event.Data.Message.Text)

// Answer 202 and queue the event like the CRM callback worker above (the request is gone after the 202).
// In the worker: http from the quickstart — its X-Api-Key header authorises the reply; replyUrl is absolute.
var replyUrl = evt.GetProperty("data").GetProperty("replyUrl").GetString();
var res = await http.PostAsJsonAsync(replyUrl, new { text = answer.Text, action = "none" }, ct);
if (res.StatusCode == System.Net.HttpStatusCode.Accepted
    && (await res.Content.ReadFromJsonAsync<JsonElement>(ct)).GetProperty("autoReply").GetProperty("state").GetString() != "on")
    Console.WriteLine("your team took over meanwhile — the answer went out anyway");

<?php
// … signature check as in the handler above …
$event = json_decode($body, true);

http_response_code(202);          // answer right away …
if (function_exists("fastcgi_finish_request")) {
    fastcgi_finish_request();     // … PHP-FPM closes the request, the script keeps running
}
if ($event["type"] !== "message.received" || $event["data"]["autoReply"]["state"] !== "on") exit; // your team has it

$answer = myAi($event["data"]);
$ch = curl_init($event["data"]["replyUrl"]);
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ["X-Api-Key: " . getenv("MEITI_API_KEY"), "Content-Type: application/json"],
    CURLOPT_POSTFIELDS => json_encode(["text" => $answer["text"], "action" => "none"]),
]);
curl_exec($ch); // 202 with "autoReply": { "state": "off" } = your team took over meanwhile, the text went out anyway

// Node + ws (npm i ws). Serve it behind TLS: meiti only connects to wss:// addresses.
import http from "node:http";
import { WebSocketServer } from "ws";

const server = http.createServer();
const wss = new WebSocketServer({ noServer: true });

// The upgrade has no body: the signature covers the X-Meiti-Call-Id header (verify() from the chat handler).
server.on("upgrade", (req, socket, head) => {
  if (!verify(req.headers["x-meiti-signature"], req.headers["x-meiti-call-id"] ?? "")) {
    socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
    return socket.destroy();
  }
  wss.handleUpgrade(req, socket, head, ws => wss.emit("connection", ws, req));
});

wss.on("connection", ws => {
  let call;
  const send = frame => ws.send(JSON.stringify(frame));
  ws.on("message", async raw => {
    const frame = JSON.parse(raw);
    switch (frame.type) {
      case "session.started": // callId, projectId, from, to, language, contact, resumed?
        call = frame;
        break;
      case "prompt": { // the caller finished a sentence
        const answer = await myAI(call, frame.text);
        if (answer.done) send({ type: "action", action: "end", text: answer.text }); // spoken, then hang up
        else if (answer.needsPerson) send({ type: "action", action: "handover", text: answer.text, note: answer.reason });
        else send({ type: "text", text: answer.text, last: true }); // or stream pieces; the last one has last: true
        break;
      }
      case "interrupt": // the caller talked over you: stop streaming the old answer
        break;
      case "session.ended":
        ws.close();
        break;
    }
  });
});

server.listen(8080);

# Python + websockets 13+ (pip install websockets). Serve it behind TLS: meiti only connects to wss://.
import asyncio, json
from http import HTTPStatus
from websockets.asyncio.server import serve

def check(connection, request):
    # The upgrade has no body: the signature covers the X-Meiti-Call-Id header (verify() from the chat handler).
    call_id = request.headers.get("X-Meiti-Call-Id", "")
    if not verify(request.headers.get("X-Meiti-Signature", ""), call_id.encode()):
        return connection.respond(HTTPStatus.UNAUTHORIZED, "bad signature\n")

async def handle(ws):
    call = None
    async for raw in ws:
        frame = json.loads(raw)
        if frame["type"] == "session.started":  # callId, projectId, from, to, language, contact, resumed?
            call = frame
        elif frame["type"] == "prompt":  # the caller finished a sentence
            answer = await my_ai(call, frame["text"])
            if answer.done:  # spoken, then hang up
                await ws.send(json.dumps({"type": "action", "action": "end", "text": answer.text}))
            elif answer.needs_person:
                await ws.send(json.dumps({"type": "action", "action": "handover", "text": answer.text, "note": answer.reason}))
            else:  # or stream pieces; the last one has "last": True
                await ws.send(json.dumps({"type": "text", "text": answer.text, "last": True}))
        elif frame["type"] == "session.ended":
            break

async def main():
    async with serve(handle, "0.0.0.0", 8080, process_request=check) as server:
        await server.serve_forever()

asyncio.run(main())

// net/http + github.com/gorilla/websocket. Serve it behind TLS: meiti only connects to wss:// addresses.
var upgrader = websocket.Upgrader{}

type frame struct {
	Type string `json:"type"`
	Text string `json:"text"`
}

func meitiVoice(w http.ResponseWriter, r *http.Request) {
	// The upgrade has no body: the signature covers the X-Meiti-Call-Id header (verify() from the chat handler).
	if !verify(r.Header.Get("X-Meiti-Signature"), []byte(r.Header.Get("X-Meiti-Call-Id"))) {
		w.WriteHeader(http.StatusUnauthorized)
		return
	}
	conn, err := upgrader.Upgrade(w, r, nil)
	if err != nil {
		return
	}
	defer conn.Close()

	var call map[string]any // session.started: callId, projectId, from, to, language, contact, resumed?
	for {
		_, raw, err := conn.ReadMessage()
		if err != nil {
			return // meiti closed the socket: the call is over
		}
		var f frame
		_ = json.Unmarshal(raw, &f)
		switch f.Type {
		case "session.started":
			_ = json.Unmarshal(raw, &call)
		case "prompt": // the caller finished a sentence
			answer := myAI(call, f.Text)
			switch {
			case answer.Done: // spoken, then hang up
				conn.WriteJSON(map[string]any{"type": "action", "action": "end", "text": answer.Text})
			case answer.NeedsPerson:
				conn.WriteJSON(map[string]any{"type": "action", "action": "handover", "text": answer.Text, "note": answer.Reason})
			default: // or stream pieces; the last one has "last": true
				conn.WriteJSON(map[string]any{"type": "text", "text": answer.Text, "last": true})
			}
		case "session.ended":
			return
		}
	}
}

func main() {
	http.HandleFunc("GET /meiti/voice", meitiVoice)
	http.ListenAndServe(":8080", nil)
}

// ASP.NET Core with WebSockets. Serve it behind TLS: meiti only connects to wss:// addresses.
using System.Net.WebSockets;
using System.Text;
using System.Text.Json;

app.UseWebSockets();
app.Map("/meiti/voice", async (HttpContext context) =>
{
    // The upgrade has no body: the signature covers the X-Meiti-Call-Id header (Verify() from the chat handler).
    var callId = context.Request.Headers["X-Meiti-Call-Id"].ToString();
    if (!context.WebSockets.IsWebSocketRequest
        || !Verify(context.Request.Headers["X-Meiti-Signature"].ToString(), Encoding.UTF8.GetBytes(callId)))
    {
        context.Response.StatusCode = StatusCodes.Status401Unauthorized;
        return;
    }

    using var ws = await context.WebSockets.AcceptWebSocketAsync();
    var ct = context.RequestAborted;
    Task Send(object frame) =>
        ws.SendAsync(new ArraySegment<byte>(JsonSerializer.SerializeToUtf8Bytes(frame)), WebSocketMessageType.Text, true, ct);

    var buffer = new byte[64 * 1024];
    JsonElement call = default;
    while (ws.State == WebSocketState.Open)
    {
        int count = 0;
        ValueWebSocketReceiveResult result;
        do
        {
            result = await ws.ReceiveAsync(buffer.AsMemory(count), ct);
            count += result.Count;
        } while (!result.EndOfMessage && result.MessageType != WebSocketMessageType.Close);
        if (result.MessageType == WebSocketMessageType.Close) break;

        using var doc = JsonDocument.Parse(buffer.AsMemory(0, count));
        var frame = doc.RootElement;
        switch (frame.GetProperty("type").GetString())
        {
            case "session.started": // callId, projectId, from, to, language, contact, resumed?
                call = frame.Clone();
                break;
            case "prompt": // the caller finished a sentence
                var answer = await MyAI.AnswerAsync(call, frame.GetProperty("text").GetString());
                if (answer.Done) await Send(new { type = "action", action = "end", text = answer.Text }); // spoken, then hang up
                else if (answer.NeedsPerson) await Send(new { type = "action", action = "handover", text = answer.Text, note = answer.Reason });
                else await Send(new { type = "text", text = answer.Text, last = true }); // or stream pieces; the last one has last = true
                break;
            case "session.ended":
                await ws.CloseAsync(WebSocketCloseStatus.NormalClosure, "bye", CancellationToken.None);
                break;
        }
    }
});

# Run one skill now (chat semantics), e.g. from your own backend. Optional body and Idempotency-Key.
curl https://api.meiti.ai/v1/projects/67890/skills/notdienst \
  -H "X-Api-Key: $MEITI_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 6f1c2a9e-notdienst" \
  -d '{ "note": "Wasser tritt aus der Decke, Kundin ist vor Ort." }'
# 200: { "key": "notdienst", "ok": true }
# 200: { "key": "notdienst", "ok": false, "reason": "outside-hours" }
# 409 project_not_with_agent: your team has the conversation — nothing ran.

// In the phone handler (see above): let your AI decide, meiti does the transfer.
case "prompt": {
  const answer = await myAI(call, frame.text, call.skills); // call = session.started, skills listed there
  if (answer.forwardTo) {
    send({ type: "text", text: answer.text, last: true });
    send({ type: "skill", executeSkills: [answer.forwardTo] }); // e.g. "buero"
  } else {
    send({ type: "text", text: answer.text, last: true });
  }
  break;
}
case "skill.result": // { key, ok, reason }: tell the caller if a forward could not run
  if (!frame.ok) send({ type: "text", text: await myAI.explain(frame.reason), last: true });
  break;

// Chat: the 200 answer of your chat endpoint (or the body of POST /v1/projects/{id}/agent-replies).
{
  "text": "Ich gebe unserem Notdienst Bescheid und verbinde Sie mit dem Büro.",
  "executeSkills": ["notdienst", "buero"],
  "note": "Wasser tritt aus der Decke, Kundin ist vor Ort."
}

// Phone: a frame on the WebSocket …
{ "type": "skill", "executeSkills": ["notdienst", "buero"], "note": "Wasser tritt aus der Decke." }
// … and meiti's answer per skill. After an ok forward the call leaves your AI (session.ended).
{ "type": "skill.result", "key": "notdienst", "ok": true }
{ "type": "skill.result", "key": "buero", "ok": true }
// Nobody answered: the caller is back on a new connection.
{ "type": "session.started", "resumed": "handover_failed", "resumedAfter": { "key": "buero", "ok": false, "reason": "no-answer" }, "…": "…" }