# Cloudonix Integration

> Configure Cloudonix for voice communication in Menace Voice

## Overview

Cloudonix is a cloud communications platform that enables Menace Agents to connect to SIP communications
platform, either on-premise or in the cloud. In addition, Cloudonix exposes a full set of voice APIs, that provide 
a full suite of call-control capabilities and more.

<Note>
  **Already have a configuration named "Menace Voice Cloudonix SIP"?** That one is
  provisioned for you — Menace Voice owns the Cloudonix domain, so it needs no
  Cloudonix account or credentials of your own. It does need you to connect
  your SIP carrier and add your phone numbers. Follow
  [Menace Voice Managed SIP](/integrations/telephony/menace-sip) instead of this page.

  This page covers bringing **your own** Cloudonix account as a separate
  configuration.
</Note>

## What you need

- A [Cloudonix account](https://cockpit.cloudonix.io/onboarding?affiliate=DOGRAH)
- A Cloudonix domain UUID (or the domain name)
- A Cloudonix domain API Key (Bearer Token)
- A Cloudonix **Voice Application** on that domain (optional — leave the field blank in Menace Voice and we'll auto-create one for you on save, with the application `url` pre-set)
- A SIP carrier or trunk that owns your phone numbers and can route calls to
  Cloudonix

## Authenticate callbacks before upgrading

Cloudonix inbound, status, CDR, and transfer callbacks require an `Authorization:
Bearer` header matching **Webhook Secret** on the call's Cloudonix configuration.
Missing or invalid authentication is rejected before call state changes. The
Cloudonix domain API token and `X-CX-APIKey` application credential are different
credentials and are not accepted as webhook authentication.

For existing deployments, roll out the configuration field and synchronization
first, prepare each configuration, and then enable the callback enforcement
changes. Enter a random secret of at least 32 characters in **Webhook Secret**
and save. Deploying enforcement before this preparation rejects existing inbound
calls and call updates until the configuration is saved. Saving reads the domain profile, preserves its other settings, and
synchronizes `authorization-api-key`. Cloudonix sends that value as its default
Bearer authorization on customer HTTP callbacks, as documented in the
[Cloudonix domain profile reference](https://developers.cloudonix.com/Documentation/dataModels/domain).
If the domain already has a different `authorization-api-key`, reuse that existing
secret; the save rejects overwriting an unknown shared secret. Rotating a secret
already managed by this configuration affects every integration on the domain.

Managed SIP provisioning generates and synchronizes the secret automatically.
Existing managed domains need their provisioning refreshed before upgrading.
Configurations without a secret cannot start outbound calls. No provider settings
are changed merely by loading the app or receiving a webhook.

Keep the domain's `cdr-endpoint` pointed at your HTTPS
`/api/v1/telephony/cloudonix/cdr` endpoint, and ensure your reverse proxy forwards
`Authorization`. Secret synchronization does not replace your existing CDR or
session endpoints. Confirm authenticated inbound, outbound completion, CDR and
transfer delivery in a provider test environment before production rollout.

## Estimated price

Cloudonix connects Menace Voice to SIP infrastructure; it is not the source of
a universal phone-number price. Your carrier bills the DID, trunk, and usage,
and Cloudonix account pricing may be quote-based. Check your carrier's current
rate card and your [Cloudonix account](https://cockpit.cloudonix.io/onboarding?affiliate=DOGRAH)
before continuing.

## Video Tutorial

Watch this step-by-step guide to set up Cloudonix with Menace Voice:

## Set up Cloudonix step by step

### 1. Prepare your Cloudonix domain and SIP carrier

1. Log in to your [Cloudonix Console](https://cockpit.cloudonix.io/onboarding?affiliate=DOGRAH)
2. Create or select the domain that will carry these calls.
3. Connect the SIP carrier or trunk that owns your number. Use the exact host,
   authentication, routing, and codec settings supplied by that carrier.
4. Confirm the number reaches the Cloudonix domain before adding Menace Voice.

### 2. Copy the credentials Menace Voice requests

1. Copy the domain name, for example `your-company.cloudonix.net`.
2. Create or copy the domain API **Bearer Token**.
3. Optionally create a dedicated **Voice Application** and copy its Application
   Name. You can leave this blank and let Menace Voice create it.

Cloudonix explains Voice Applications in its [official guide](https://docs.cloudonix.com/docs/voice-applications/).

### 3. Connect Cloudonix in Menace Voice

1. Open **Phone numbers** and click **Add phone number**.
2. Choose **Cloudonix** and continue.
3. Paste the **Bearer Token** and **Domain Name**.
4. Paste the **Application Name**, or leave it blank so Menace Voice creates a
   dedicated Application.
5. Enter the carrier-owned number with its country code.
6. Choose an agent for incoming calls and finish setup.

   <Note>
     If Menace Voice auto-created the Voice Application for you, you still need to
     bind your DNIDs to that application in the Cloudonix cockpit (see
     [Step 2 of Inbound Calling Setup](#step-2-create-the-voice-application-and-link-dnids)).
     The auto-created application is named `dograh-<random>` — its name is
     shown on the saved configuration.
   </Note>

### 4. Bind the number and test

1. In Cloudonix, bind the number's DNID to the Voice Application used by Menace
   Voice.
2. Call the number from another phone and confirm the selected agent answers.
3. Place one outbound test call before using the connection in a campaign.

## Inbound Calling Setup

Cloudonix routes inbound calls per **Voice Application** — the webhook URL is set once on the application, and applies to every DNID bound to it. **When you save an inbound workflow on a phone number, Menace Voice automatically pushes the webhook URL to your Voice Application's `url`** (provided the credentials are correct), so you don't need to set the webhook by hand. If Menace Voice auto-created the application during configuration save, the `url` is already set and this push is a no-op — you only need to bind your DNIDs to the auto-created application.

### Step 1: Set Up the Inbound Trunk

1. Log in to your [Cloudonix Console](https://cockpit.cloudonix.io)
2. Navigate to **Trunks** → **Create Inbound Trunk** and configure your inbound trunk with your voice service provider

   <img
     className="block dark:hidden"
     src="/images/cloudonix-inbound-config-1.png"
     alt="Cloudonix console showing domain selection"
   />
   <img
     className="hidden dark:block"
     src="/images/cloudonix-inbound-config-1.png"
     alt="Cloudonix console showing domain selection"
   />

### Step 2: Create the Voice Application and Link DNIDs

1. In the Cloudonix cockpit, select your domain and navigate to **Applications**
2. Create a new application (or open the existing one whose name you configured in Menace Voice) with these settings:
   - **Application Resource Type**: `Remote Application Resource`
   - **Application Runtime**: `Cloudonix (CXML)`
   - **Application URL**: `https://voice.menaceui.com/api/v1/telephony/inbound/run`
   - **HTTP Method**: `POST`
3. Under **DNID Numbers**, add each phone number (DNID) you want to route through this application
4. Save

   <Note>
     The Application URL is what Menace Voice's auto-push updates in Step 3 — you
     can leave it blank during creation and let the auto-push fill it in,
     or paste the URL above so the application is usable immediately.
     Either works. Self-hosted Menace Voice deployments use their backend domain
     in place of `voice.menaceui.com`.
   </Note>

   <img
     className="block dark:hidden"
     src="/images/cloudonix-inbound-config-application.png"
     alt="Cloudonix application form showing Remote Application Resource type, Cloudonix CXML runtime, the Menace Voice inbound URL, POST method, and a DNID number entry"
   />
   <img
     className="hidden dark:block"
     src="/images/cloudonix-inbound-config-application.png"
     alt="Cloudonix application form showing Remote Application Resource type, Cloudonix CXML runtime, the Menace Voice inbound URL, POST method, and a DNID number entry"
   />

### Step 3: Assign an Inbound Workflow to the Phone Number in Menace Voice

1. Go to **/telephony-configurations** and open your Cloudonix configuration
2. In the **Phone numbers** section, edit the number that should receive inbound calls
3. Set its **Inbound workflow** to the agent that should answer
4. Save

### Step 4: Verify the URL on the Voice Application

1. Open your Cloudonix cockpit and navigate to your domain's **Applications**
2. Open the application whose name you configured in Menace Voice
3. Confirm:
   - **URL** is set to: `https://voice.menaceui.com/api/v1/telephony/inbound/run`
   - **Method** is `POST`

   <Note>
     Menace Voice pushed this URL automatically when you saved the inbound workflow
     in Step 3. The same URL is shared across every DNID bound to that
     application — Menace Voice routes each inbound call to the right agent based
     on the called number's inbound workflow assignment. If the field is
     empty, shows a different URL, or Menace Voice surfaced a sync warning on
     save, the auto-push failed — most often because the Bearer Token,
     Domain ID, or Application Name in Menace Voice is incorrect. Paste the URL
     into the field yourself, set the method to `POST`, and save. On
     self-hosted Menace Voice, replace `voice.menaceui.com` with your backend domain.
   </Note>

   <img
     className="block dark:hidden"
     src="/images/cloudonix-inbound-config-2.png"
     alt="Cloudonix application showing webhook URL configuration"
   />
   <img
     className="hidden dark:block"
     src="/images/cloudonix-inbound-config-2.png"
     alt="Cloudonix application showing webhook URL configuration"
   />

### Step 5: Verify Setup

- Ensure your Menace Voice instance is publicly accessible
- Verify any firewalls allow Cloudonix's IP ranges
- Confirm your inbound trunk is active and receiving calls

### Test Inbound Calling

1. Call your configured phone number from another phone
2. Verify your Menace Voice agent answers and responds
3. Check call logs in both Menace Voice dashboard and Cloudonix Console
4. Confirm clear two-way audio communication

## Troubleshooting

<AccordionGroup>
  <Accordion title="Invalid phone number error">
    Ensure phone numbers include country code in E.164 format: `+1234567890`
  </Accordion>
  
  <Accordion title="Authentication failed">
    - Verify Domain ID, Bearer Token, and Application Name are correct
    - Check for extra spaces in credentials
    - Ensure credentials haven't been disabled or deleted in Cloudonix Console
  </Accordion>

  <Accordion title="No audio on calls">
    - Verify WebSocket connection is established
    - Check firewall rules for WebSocket traffic
    - Ensure audio pipeline is configured correctly
  </Accordion>

  <Accordion title="Inbound calls not reaching voice agent">
    - Verify the DNID is bound to the same Voice Application whose name you
    configured in Menace Voice - Confirm the called number exists in your Menace Voice
    telephony configuration and has an **Inbound workflow** assigned -
    After assigning the inbound workflow, confirm Menace Voice successfully updated
    the application's `url` (no warning shown on save) - Verify your inbound
    trunk is active and receiving calls
  </Accordion>

  <Accordion title="Voice agent doesn't respond to inbound calls">
    - Confirm the phone number has an **Inbound workflow** assigned in
    /telephony-configurations - Verify the Bearer Token in Menace Voice matches the
    one in your Cloudonix Console - Verify WebSocket connection establishes
    successfully - Review call logs for error messages
  </Accordion>
</AccordionGroup>

## Best Practices

- Test your configuration with a single call before running campaigns
- Monitor Cloudonix Sessions for usage
- Use a dedicated Voice Application for Menace Voice so the shared `url` doesn't conflict with other systems