> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pineyard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Start a WebRTC sandbox session against this agent

**Required scope:** `calls.test`

**Idempotency:** an `Idempotency-Key` header is required when calling with an API key. See [Idempotency](/concepts/idempotency).


## OpenAPI

````yaml /api-reference/openapi.json post /agents/{id}/web-session
openapi: 3.0.3
info:
  title: Pineyard API
  version: 1.0.0
  description: >-
    Programmatic access to agents, campaigns, calls, phone numbers, WhatsApp and
    results in your Pineyard workspace.
servers:
  - url: https://api.pineyard.ai
    description: Production
security:
  - bearerAuth: []
paths:
  /agents/{id}/web-session:
    post:
      summary: Start a WebRTC sandbox session against this agent
      parameters:
        - schema:
            type: string
          required: true
          name: id
          in: path
        - name: Idempotency-Key
          in: header
          required: true
          description: >-
            Unique value (e.g. a UUID) per action, up to 200 printable ASCII
            characters. Reuse it only to retry the same request; the first
            response is replayed for 24 hours.
          schema:
            type: string
            maxLength: 200
            example: f1d2c3b4-0000-4000-8000-000000000000
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                variables:
                  type: object
                  additionalProperties:
                    type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  callId:
                    type: string
                  roomUrl:
                    type: string
                  token:
                    type: string
                required:
                  - callId
                  - roomUrl
                  - token
        '400':
          description: >-
            - `agent_not_provisioned`: The agent is still being set up.

            - `idempotency_key_invalid`: Idempotency-Key is over 200 chars or
            has non-printable or non-ASCII characters.

            - `idempotency_key_required`: A billed endpoint was called without
            an `Idempotency-Key` header (`400`), or a `/v1` lead push without
            `idempotencyKey` in the body (`422`).

            - `internal_error`: An unexpected error. A `400` with this code
            usually means the body is not valid JSON; a `413` means the body is
            larger than 1 MB.

            - `invalid_body`: The request body (or query) failed validation.
            Details are in `issues` (or `detail`). `422` on `POST
            /v1/campaigns/{campaignId}/leads`.
        '401':
          description: >-
            - `invalid_api_key`: The API key is unknown, revoked or expired, or
            its workspace was deleted.

            - `unauthorized`: No `Authorization: Bearer` header, or an empty
            token.
        '402':
          description: >-
            - `activity_frozen`: Workspace activity is frozen.

            - `insufficient_credits`: Wallet balance too low (and no active
            trial).

            - `workspace_not_active`: Workspace is not ACTIVE, so no billable
            activity is allowed.
        '403':
          description: >-
            - `api_key_not_scoped`: A key issued without scopes was used outside
            `/v1`.

            - `api_key_owner_inactive`: The member the key acts for was removed
            or suspended.

            - `forbidden`: The key lacks the permission named in
            `requiredPermission`, or the resource belongs to another workspace.

            - `workspace_pending_approval`: The workspace has not been approved
            yet.

            - `workspace_suspended`: The workspace is suspended.
        '404':
          description: >-
            - `agent_not_found`: Agent id missing or not in this workspace (400
            on POST /v1/campaigns, inbound-number assignment and suggest
            routes).
        '409':
          description: >-
            - `idempotency_in_progress`: A request with the same Idempotency-Key
            is still running.
        '413':
          description: >-
            - `internal_error`: An unexpected error. A `400` with this code
            usually means the body is not valid JSON; a `413` means the body is
            larger than 1 MB.
        '422':
          description: >-
            - `idempotency_key_reused`: The `Idempotency-Key` was already used
            for a different request (`422`). On `POST /calls/test`, `409` means
            a call with this key already exists.
        '429':
          description: '- `rate_limited`: Too many requests.'
        '500':
          description: >-
            - `internal_error`: An unexpected error. A `400` with this code
            usually means the body is not valid JSON; a `413` means the body is
            larger than 1 MB.
        '501':
          description: '- `web_session_not_supported`: Web test sessions are not available.'
        '502':
          description: >-
            - `provider_error`: The calling service rejected the request
            (`upstreamStatus` 4xx) or was unavailable (5xx).
        '503':
          description: >-
            - `database_unavailable`: The service is temporarily unavailable.

            - `idempotency_unavailable`: The idempotency check could not run.
            Nothing was done.
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Your API key, e.g. `pk_live_xxxxxxxxxxxxxxxxxxxxxxxx`.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.