Security
The security center protects the phone system from unauthorized access attempts: automatic blocking of suspicious addresses, geographic restrictions, a list of trusted addresses and an event log.
For tenants
GET /v1/security/summary (scope extensions:read) summarizes the access attempts blocked in recent hours, extension by extension: useful for spotting exposed SIP credentials or misconfigured phones.
curl -s https://centralino.exovoip.it/api/v1/security/summary -H "X-API-Key: $EXOPBX_API_KEY"const summary = await pbx.security.summary(); // tentativi bloccati per interno$summary = $pbx->security->summary();summary = pbx.security.summary()For the platform
The other endpoints are reserved for global keys (scopes security:read / security:write):
| Feature | Endpoint |
|---|---|
| Overall status (active protections, blocked addresses, attempts per hour and per country) | GET /v1/security/status |
| Blocked addresses, manual block and unblock | GET/POST /v1/security/bans, POST /v1/security/bans/unban |
| Automatic blocking rules (attempts, window, duration) | GET /v1/security/jails, PUT /v1/security/jails/:name |
| Geographic restrictions per service (SIP, WebRTC, control panel, API, SSH) | GET /v1/security/geo, PUT /v1/security/geo/:service |
| Trusted addresses (never blocked), also per tenant or extension | GET/POST /v1/security/whitelist, DELETE /v1/security/whitelist/:id |
| Settings and event log | GET/PUT /v1/security/settings, GET /v1/security/logs |
| Trunk verification (network overlap) | GET /v1/trunks/approvals, POST /v1/trunks/:id/approve, POST /v1/trunks/:id/reject |
curl -s https://centralino.exovoip.it/api/v1/security/status -H "X-API-Key: $EXOPBX_API_KEY"
curl -s -X POST https://centralino.exovoip.it/api/v1/security/bans -H "X-API-Key: $EXOPBX_API_KEY" \
-H "Content-Type: application/json" -d '{"ip":"203.0.113.10","durationS":3600,"reason":"manual"}'
curl -s -X POST https://centralino.exovoip.it/api/v1/security/bans/unban -H "X-API-Key: $EXOPBX_API_KEY" \
-H "Content-Type: application/json" -d '{"ip":"203.0.113.10"}'
curl -s -X POST https://centralino.exovoip.it/api/v1/security/whitelist -H "X-API-Key: $EXOPBX_API_KEY" \
-H "Content-Type: application/json" -d '{"cidr":"198.51.100.0/24","label":"Sede Acme","tenantId":3}'const status = await pbx.security.status();
await pbx.security.ban({ ip: '203.0.113.10', durationS: 3600, reason: 'manual' });
await pbx.security.unban({ ip: '203.0.113.10' });
await pbx.security.addWhitelist({ cidr: '198.51.100.0/24', label: 'Sede Acme', tenantId: 3 });$status = $pbx->security->status();
$pbx->security->ban(['ip' => '203.0.113.10', 'durationS' => 3600, 'reason' => 'manual']);
$pbx->security->unban(['ip' => '203.0.113.10']);
$pbx->security->addWhitelist(['cidr' => '198.51.100.0/24', 'label' => 'Sede Acme', 'tenantId' => 3]);status = pbx.security.status()
pbx.security.ban({"ip": "203.0.113.10", "durationS": 3600, "reason": "manual"})
pbx.security.unban({"ip": "203.0.113.10"})
pbx.security.add_whitelist({"cidr": "198.51.100.0/24", "label": "Sede Acme", "tenantId": 3})API keys can also be restricted by IP address: see Authentication.
Endpoints
| Request | Scope | SDK method |
|---|---|---|
GET /v1/security/summary | extensions:read | security.summary() |
GET /v1/security/status | security:read | security.status() |
GET /v1/security/bans | security:read | security.bans() |
POST /v1/security/bans | security:write | security.ban() |
POST /v1/security/bans/unban | security:write | security.unban() |
GET /v1/security/jails | security:read | security.jails() |
PUT /v1/security/jails/:name | security:write | security.updateJail() · py: security.update_jail() |
GET /v1/security/geo | security:read | security.geo() |
PUT /v1/security/geo/:service | security:write | security.updateGeo() · py: security.update_geo() |
GET /v1/security/whitelist | security:read | security.whitelist() |
POST /v1/security/whitelist | security:write | security.addWhitelist() · py: security.add_whitelist() |
DELETE /v1/security/whitelist/:id | security:write | security.deleteWhitelist() · py: security.delete_whitelist() |
GET /v1/security/settings | security:read | security.getSettings() · py: security.get_settings() |
PUT /v1/security/settings | security:write | security.setSettings() · py: security.set_settings() |
GET /v1/security/logs | security:read | security.logs() |