> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ondial.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Create inbound agent

> Create an agent on a number you already own (starts inactive). Optionally link companyId and KB fileIds.

`phoneNumber` or `phoneNumberId` required. Healthcare HMS fields (`appointmentScope`, `customApiBaseUrl`, …) are optional. Then [activate](/api-reference/endpoint/inbound-agents/activate-inbound-agent).

## Company + knowledge base

Recommended HMS order:

1. [List companies](/api-reference/endpoint/companies/list-companies) → pick `id`
2. [List knowledge documents](/api-reference/endpoint/knowledge-bases/list-documents) → pick `fileId`s
3. Create agent with `companyId` and `selectedKnowledgebases: ["fileId", …]`

If `companyId` is omitted, Ondial auto-picks the tenant’s latest company. Unknown or other-tenant ids → `422` (`company_not_found` / `knowledge_document_not_found`).

Full HMS walkthrough: [Healthcare HMS integration](/get-started/guides/healthcare-hms-integration).


## OpenAPI

````yaml openapi.json POST /api/v1/inbound-agents
openapi: 3.0.3
info:
  title: Ondial Public API
  version: 1.0.0
  description: >-
    Tenant API-key surface for lead ingest, contacts (including dial
    conversation + analysis), events, inbound agents, company profiles, and
    knowledge-base documents.


    **Campaign definition is UI-only** — create and start an API-ingest campaign
    in the dashboard, then push leads here.


    **Auth:** `Authorization: Bearer ond_live_…` or `ond_test_…` (or
    `X-API-Key`). Keys are requested in **API Access** with a friendly **key
    name**, then approved by Super Admin (not self-serve). Tenants can rename
    keys later without rotating the secret.


    **Scopes:** Company and knowledge-base routes require opt-in scopes
    (`companies:read`, `companies:write`, `knowledge:read`, `knowledge:write`)
    granted at key approval. Missing scope → `403 forbidden`.


    **Sandbox** keys never place PSTN dials or live WhatsApp/email and do not
    burn credits (KB upload skips debit).


    **Security:** Company responses never include SMTP/WhatsApp credentials. KB
    v1 is metadata-only — no file download.


    **Kill switch:** Super Admin can disable all `/api/v1/*` (`503` /
    `api_globally_disabled`) without stopping UI CSV campaigns.


    **Compliance:** Call channel requires `consent.outboundCall: true` and phone
    not on tenant/platform DNC.
servers:
  - url: https://dashboard.ondial.ai
    description: Production
  - url: http://localhost:3001
    description: Local
security:
  - BearerAuth: []
tags:
  - name: Core
    description: Auth check and lead ingest
  - name: Contacts
    description: Status, dials/conversation/analysis, cancel, delete, follow-ups, list
  - name: Events
    description: ERP event bus slice — eventType → campaign
  - name: Outbound
    description: >-
      Read-only campaign lookup for API / Custom CRM. Create and start campaigns
      in the dashboard.
  - name: Inbound agents
    description: Configure inbound agents; list/buy pool numbers; read credits
  - name: Companies
    description: >-
      Company profile CRUD (requires companies:read / companies:write scopes).
      Never returns SMTP or WhatsApp credentials.
  - name: Knowledge bases
    description: >-
      Knowledge document upload/list/delete (requires knowledge:read /
      knowledge:write scopes). Metadata only — no file download via API.
paths:
  /api/v1/inbound-agents:
    post:
      tags:
        - Inbound agents
      summary: Create inbound agent on owned number
      description: >-
        Number must already be owned. Agent starts inactive. Healthcare HMS:
        pass appointmentScope, customApiBaseUrl, and flags (see Healthcare HMS
        guide).
      operationId: createInboundAgent
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InboundAgentCreate'
            example:
              name: Main hospital line
              category: healthcare_reception
              phoneNumber: '+919876543210'
              appointmentScope: hospital
              branchId: YOUR_BRANCH_ID
              customApiBaseUrl: https://YOUR_HMS_HOST/ondial
              customApiSecret: YOUR_SHARED_SECRET
              slotsEnabled: true
              bookingEnabled: true
      responses:
        '201':
          description: Created (typically inactive until activate)
          content:
            application/json:
              schema:
                type: object
                properties:
                  agent:
                    $ref: '#/components/schemas/InboundAgent'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '422':
          description: >-
            phone_not_owned / phone_required / phone_already_configured / HMS
            scope validation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorBody'
components:
  schemas:
    InboundAgentCreate:
      type: object
      properties:
        name:
          type: string
        category:
          type: string
          example: healthcare_reception
        phoneNumber:
          type: string
        phoneNumberId:
          type: string
        greetingMessage:
          type: string
        companyId:
          type: string
          description: >-
            Optional. Must be owned by the API-key tenant (from GET /companies).
            If omitted, Ondial auto-picks the latest company.
        selectedKnowledgebases:
          type: array
          description: >-
            Optional. Array of fileId strings (or { fileId }) from GET
            /knowledge-bases/documents. Ondial resolves titles/knowledgebaseId.
          items:
            oneOf:
              - type: string
              - type: object
                properties:
                  fileId:
                    type: string
                required:
                  - fileId
          example:
            - 1730000000-brochure.pdf
        appointmentScope:
          type: string
          enum:
            - global
            - hospital
            - doctor
          description: 'Healthcare HMS: one number = one scope.'
        branchId:
          type: string
          description: >-
            Required for hospital and doctor scopes. Use your HMS hospital/org
            ID.
        doctorId:
          type: string
          description: Required for doctor scope. Use your HMS doctor ID.
        customApiBaseUrl:
          type: string
          example: https://YOUR_HMS_HOST/ondial
        customApiSecret:
          type: string
          description: 'Optional shared secret; Ondial sends Authorization: Bearer …'
        customApiTimeoutMs:
          type: integer
        slotsEnabled:
          type: boolean
        bookingEnabled:
          type: boolean
        doctorsSyncEnabled:
          type: boolean
        validateHookEnabled:
          type: boolean
    InboundAgent:
      type: object
      properties:
        id:
          type: string
        _id:
          type: string
        name:
          type: string
        phoneNumber:
          type: string
        category:
          type: string
        status:
          type: string
          enum:
            - active
            - inactive
        inboundScriptStatus:
          type: string
          enum:
            - none
            - generating
            - ready
            - error
        greetingMessage:
          type: string
        companyId:
          type: string
          nullable: true
          description: Linked company profile id from GET /api/v1/companies
        selectedKnowledgebases:
          type: array
          description: >-
            Linked KB docs (metadata only). Assign with fileId list from GET
            /api/v1/knowledge-bases/documents.
          items:
            type: object
            properties:
              fileId:
                type: string
              fileName:
                type: string
                nullable: true
              title:
                type: string
                nullable: true
              knowledgebaseId:
                type: string
                nullable: true
              wordCount:
                type: integer
        appointmentScope:
          type: string
          enum:
            - global
            - hospital
            - doctor
          nullable: true
        branchId:
          type: string
          nullable: true
        doctorId:
          type: string
          nullable: true
        slotsEnabled:
          type: boolean
        bookingEnabled:
          type: boolean
        doctorsSyncEnabled:
          type: boolean
        validateHookEnabled:
          type: boolean
        doctorsLastSyncedAt:
          type: string
          format: date-time
          nullable: true
        customApiBaseUrl:
          type: string
          nullable: true
    ErrorBody:
      type: object
      properties:
        error:
          type: string
        reasonCode:
          type: string
        missing:
          type: array
          items:
            type: string
  responses:
    Unauthorized:
      description: Missing, invalid, or inactive API key
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorBody'
          example:
            error: Invalid or inactive API key
            reasonCode: unauthorized
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: ond_live | ond_test
      description: >-
        Paste only your API key (`ond_live_…` or `ond_test_…`). Do not type the
        word Bearer — the playground adds it.

````