numbersonline
PBX & softphone integrations

Integrations

Drop-in artifacts that label inbound calls with a caller name (CNAM) and an optional, low-confidence supplementary risk signal — for FreePBX, FreeSWITCH / FusionPBX, 3CX, MicroSIP, and AI voice agents (an MCP server plus Vapi and Retell webhooks). Each is copy-paste, runs on the free tier, and fails open on the call path: a slow or failing lookup never delays or blocks a call. Your PBX or agent keeps every routing, labeling, and blocking decision.

FreePBX
CID Superfecta source

Add numbers.online as a caller-name (CNAM) source in FreePBX’s CID Superfecta module. On each inbound call Superfecta asks numbers.online for the caller’s name and — if you opt in — flags higher-risk callers using a low-confidence, supplementary spam signal at a threshold you choose. It is a single drop-in PHP file configured entirely from the FreePBX admin UI; your PBX keeps every routing, labeling, and blocking decision.

Install
  1. Drop source-NumbersOnline.module into Superfecta’s sources/ directory and run fwconsole chown.
  2. In Admin → CID Superfecta, enable the NumbersOnline source in your inbound route’s scheme and order it above your fallbacks.
  3. Paste your API key into the source’s API_Key field; optionally set the spam flag and threshold. It fails open — a slow or failing lookup never delays the call.
Full guide →
FreeSWITCH / FusionPBX
mod_cidlookup or Lua dialplan

Label an inbound call with a caller name and an optional risk tag before it reaches an extension. The simplest path points FreeSWITCH’s mod_cidlookup at the plain-text /v1/cid endpoint (it pastes the response body verbatim as the caller name). For routing on the risk score, header auth, and verified TLS, the included Lua dialplan script calls the JSON /v1/lookup endpoint instead. Risk wording is opt-in — you choose the tag text and threshold.

Install
  1. mod_cidlookup: copy cidlookup.conf.xml to conf/autoload_configs/, set your key in the ?key= URL param and your default country, then reload mod_cidlookup.
  2. Lua (optional, fuller): copy numbers_online_cnam.lua to conf/scripts/, set numbers_online_key in vars.xml (never hardcoded), and call it early in the inbound route.
  3. Multi-tenant FusionPBX: mint a per-tenant sub-key through the MSP control plane so usage and billing are attributed per domain.
Full guide →
3CX
Server-side CRM source

Add numbers.online as a server-side CRM source so 3CX resolves unknown inbound callers to a business name, tenant-wide, with no client-side software. When a call arrives from a number that is not already a 3CX contact, 3CX requests a caller name (CNAM) and shows it on a hit. Known 3CX contacts always win, and a number with no available name simply shows as the raw number — nothing is invented.

Install
  1. In the 3CX Admin Console, go to Settings → CRM → Server side and upload numbers-online.crm.xml.
  2. Paste your API key into the numbers.online API Key field and save.
  3. Restart the 3CX System Service (required), then use the built-in CRM Test with a +E.164 number to verify.
Full guide →
MicroSIP
Windows softphone toast

Show a caller’s name, line type, and a low-confidence risk signal as a Windows toast the moment an inbound call rings your MicroSIP softphone. MicroSIP runs a command on each incoming call; a PowerShell script normalizes the number, calls the lookup API, and pops a desktop notification. This is a desktop demo of the lookup signal — for production call flows the integration point is your PBX/SBC. An operator-chosen risk label is prefixed only above a threshold you set.

Install
  1. Save NumbersOnlineLookup.ps1 and numbers-online-lookup.bat to C:\tools\numbers-online\.
  2. Set your key as the NUMBERS_ONLINE_API_KEY user environment variable (the script reads it from there — never stored in the file).
  3. Point microsip.ini’s cmdIncomingCall at the .bat wrapper and restart MicroSIP. It fails open and logs nothing.
Full guide →
AI voice agents (MCP)
Model Context Protocol server

Give an AI voice agent — Vapi, Retell, Pipecat, LiveKit — read-only phone intelligence over the Model Context Protocol. A single Streamable HTTP endpoint exposes five tools (phone_lookup, line_type, caller_risk, dnc_check, reassigned_check) the model can call before it burns agent minutes: who is this caller, and is this number one I should think twice about dialing. dnc_check and reassigned_check are preview tools that return “unknown” (and are unbilled) until a licensed data partner is configured. Every answer is a supplementary, low-confidence signal with an optional signed receipt — the agent keeps the routing and dialing decision.

Install
  1. Mint an API key with the “mcp” use case (any lookup-entitled key already has it).
  2. In Vapi, add an MCP tool pointing at https://numbers.online/api/v1/mcp with metadata.protocol "shttp" and an Authorization: Bearer header (sample below).
  3. Vapi auto-discovers the tools via tools/list. It fails open and stays well under the 7.5s assistant-request budget; a slow lookup degrades to a neutral signal, never a dropped call.
Full guide →
Retell
AI agent — call_inbound webhook

Resolve an inbound caller for a Retell agent before it answers. Point Retell’s call_inbound webhook at numbers.online and it injects dynamic variables — caller name, line type, a low-confidence risk signal, and DNC / reassigned status — into the agent prompt as {{caller_risk}}, {{caller_on_dnc}}, and friends, plus a signed receipt id. The webhook always returns 200 within Retell’s 10s budget (fail-open), so a slow or failing lookup never keeps the caller ringing.

Install
  1. Set your agent’s inbound webhook URL to /api/v1/integrations/retell/inbound?key=YOUR_API_KEY (use a dedicated, rotatable key).
  2. Reference the injected variables in your agent prompt — they are labeled supplementary signals, not verdicts.
  3. Verify with a test inbound call; the response includes a receipt_id you can retrieve later as TCPA-defense evidence.
Full guide →
Vapi
AI agent — custom function tool

Prefer a Vapi custom function tool over the MCP server? Add a phone_lookup function whose server URL is numbers.online; Vapi calls it mid-conversation and the agent gets back the same supplementary intelligence bundle (validity, line type, carrier, caller name where available, spam signal, DNC / reassigned status) as a JSON string, with a signed receipt id. Fail-open: a bad argument or supplier hiccup returns a graceful message the agent can speak around.

Install
  1. Add the custom function tool to your assistant, server URL https://numbers.online/api/v1/integrations/vapi/tool with an Authorization: Bearer header (sample below).
  2. Use a key with the “mcp” use case; each call meters the bundled per-call rate.
  3. For full MCP tool discovery instead, use the “AI voice agents (MCP)” card above — both share one lookup backend.
Full guide →
Kamailio
SIP redirect server (http_async_client shim)

Turn a Kamailio instance into a ClearIP-compatible SIP redirect server in front of your SBC. On an inbound INVITE the included config asks numbers.online for a low-confidence decision on the calling number and maps it to a SIP reply — 603 to decline, 302 to divert to a screening target you configure, or a 503/404 route-advance to allow. It fails open within a tight call-setup budget: a slow or failing lookup advances the call unchanged. Your route logic — not numbers.online — keeps every decision; a 603 only ever follows a deterministic or government/licensed-authoritative fact.

Install
  1. Load http_async_client + jansson and include numbers_online_sbc.cfg in kamailio.cfg.
  2. Put your API key in a Kamailio define/AVP (never hardcoded in the committed cfg); the recipe reads it from there and sets a sub-second $http_req(timeout).
  3. Call the route early on INVITE; map decision=block→sl_send_reply("603"), decision=redirect→302 to your screening Contact, else route-advance. It fails open on timeout/error.
Full guide →
OpenSIPS
SIP redirect (rest_client shim)

Call numbers.online from an OpenSIPS routing script via rest_client when an inbound INVITE arrives, then act on the supplementary decision — relay, divert with a 3xx, or decline with 603 — before the call reaches a trunk or extension. The signal is advisory and coverage is partial; treat any uncertainty as allow. Note the rest_client timeout is second-granular, so the OpenSIPS path’s worst case is ~1s rather than sub-500ms — size your call-setup budget accordingly. OpenSIPS keeps every routing and blocking decision.

Install
  1. Enable the rest_client + json modules and include numbers_online_sbc.cfg in opensips.cfg.
  2. Store your API key in a script var/AVP loaded from the environment — never commit it.
  3. Invoke the lookup route on INVITE and branch on the JSON decision; it fails open so a timeout relays the call.
Full guide →
dSIPRouter
Kamailio-based SBC control plane

Run the Kamailio redirect recipe under dSIPRouter so inbound calls across your endpoint groups get a supplementary numbers.online signal. Multi-tenant deployments mint a per-tenant sub-key through the MSP control plane so usage and billing roll up per customer. Advisory only — your routing rules keep every decision. (A packaged dSIPRouter/dOpenSource add-on listing is a distribution step, not required to use the recipe.)

Install
  1. Apply the Kamailio numbers_online_sbc.cfg to your dSIPRouter-managed Kamailio config and reload.
  2. Per tenant, mint a sub-key via the MSP control plane and set it in that tenant’s config so usage rolls up per customer.
  3. Branch on the decision in your inbound route; it fails open on the call-setup path.
Full guide →

Before you start

Every integration needs a numbers.online API key. Sign up self-service — the key is shown exactly once and stored only as a hash, so save it. The free tier is unbilled at 60 requests/min, enough to evaluate and run a low-volume PBX. Standard tier bills per dip ($0.004 with a fresh wholesale CNAM dip, $0.002 from cache or when no CNAM supplier resolves a name; invalid numbers are free). See the API reference to get a key and read the full lookup contract, or follow a step-by-step integration guide — one per platform, ordered simplest first.

A supplementary signal, not a verdict

numbers.online returns an advisory caller name and a low-confidence, supplementary spam signal. It never asserts that a call is lawful, unlawful, “safe”, or otherwise — the risk signal is a labeled, opt-in input, and whether any risk wording reaches a caller name is your choice (you set the tag text and threshold). Coverage is partial and reflects number-range and wholesale data, not real-time porting; treat a missing name as “unknown”, never as a negative signal. Your operator keeps every routing, labeling, and blocking decision and remains responsible for compliance.

Outbound pre-call check & call-provenance (spoofing defence)

Placing outbound calls — a dialer, an SBC, or an AI voice agent? Call /api/v1/precall/lookup right before you dial. It returns a do-not-call scrub on the destination (SUPPRESS / NO_MATCH / UNKNOWNNO_MATCH is not a consent grant) plus a supplementary compliance signal, and it is free/bundled, not metered. Separately, you can enrol one of your own verified business numbers via /api/v1/precall/enroll: once enrolled, each pre-call check records a short-lived, hashed (from → to) edge. If a call you never placed is later reported against your number, the absence of that edge distinguishes your enrolled, attested calls from spoofed ones — a supplementary spoofing signal that shields the real owner, never a block. Both endpoints need a key with the precall use case (every self-service key has it); enrolment is account-level and limited to numbers you own. See the API reference.

Passing STIR/SHAKEN attestation

If your switch already has a STIR/SHAKEN result for the call, pass it to the inbound lookup as a top-level verstat (a bare token such as TN-Validation-Passed, a verstat=… parameter, or a full SIP/tel header value) and/or attestation (A|B|C); the MCP phone_lookup and caller_risk tools accept the same verstat argument. When present it folds into the supplementary spam signal — a verified call trusts our read for that call, a failed validation is treated as a possibly-spoofed origin — and corroborated failures across independent sources improve spoofing detection for the number over time. It is a supplementary signal, never a verdict on the call.

Multi-tenant (MSPs & resellers)

Running many downstream customers or FusionPBX domains under one account? Create a tenant and mint a per-tenant sub-key so usage, billing rollups, rate limits, and suppression lists are attributed per customer while all spend draws on your single prepaid balance. The tenant control plane lives under /api/v1/account/tenants — see the API reference.