The portal

Every screen of the console, control by control — the agent builder and each of its eight tabs, the queue of calls, what every page shows and what each of its states means. Written for whoever runs the account rather than for whoever writes the code.

Getting in

One screen with several states, each named at the top.

Back to sign in returns from any of them. /invite lands directly on the invitation screen. Password reset has no link to land on: the code is typed into the same screen that asked for it.

An account that belongs to no client yet gets a page saying so rather than an empty console. It tells three situations apart, because only one of them needs you to do anything: a platform operator is meant to be there and has every account in the switcher in front of them; somebody with accounts but none entered can pick one; and somebody with no accounts at all is told plainly that the fix is a row in somebody else's members table, rather than being pointed at a switcher that is empty and disabled.

The shell around every page

The sidebar

Six groups. Which entries appear depends on your role and on what the deployment has switched on.

Two old bookmarks still work: /providers and /models both land on Integrations, which is what they were merged into. A dead bookmark reads as the feature having been removed rather than renamed.

The topbar

Names the page, and under it which account that page is about — the question a platform operator with six clients open asks every time they look up.

On a Platform page it reads Platform · every account instead. That is not decoration: you read "Acme Logistics" over a list of eight accounts and cannot tell whether you are about to change one of them or all of them.

On the right, five things that are reachable from everywhere because none of them is a place — they are actions you take while looking at something else:

The project lens

When an account has more than one project, pages that hold work show a project scope bar: which cost centre the page below is showing, changed in place. The topbar carries a chip saying the same thing, and rows in tables carry a coloured dot and the project's name — never the dot alone, because colour is what makes forty rows scannable and it is also the one channel a reader may not have.

A project that has since been deleted still shows on the row it was recorded on, as Deleted project, rather than vanishing.

The portal is the API

Nothing in the console is a private feature. Every screen here reads and writes the same endpoints your own code can, with the same permissions — the portal signs a person in where an API key authenticates a program, and that is the whole difference.

Which matters in two directions. Anything you can do here you can automate; and anything that looks wrong here can be checked against the API without waiting for a screen to be fixed. The Dialer places exactly this call:

curl -X POST https://voice.sphoro.com/v1/calls \
  -H "Authorization: Bearer $SPHORO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"agent_id": "agt_...", "to": "+919000000000"}'

Keys are minted on API keys. The full surface is the API reference, and authentication covers the header, the roles and the error codes.

Roles: who sees what

Five roles. Authorization is decided on the server for every request; the portal hides what you cannot use rather than letting you press it and take a refusal.

The Operator role exists because "member" used to be the floor, and a member builds agents: there was no way to give somebody a handset without also giving them the configuration system behind it. A support desk hiring twenty people to take calls had to make twenty people who could each rewrite the agent that takes them.

You can never grant a role above your own, and a role picker only offers what you may actually assign.

Overview

The page the portal opens on: what this account is, what it is doing right now, and who has been in it. Overview and Monitor used to be two pages that opened on the same question and answered half of it each. They are one page now, and an old link to /portal/monitor lands here. Analytics followed for the same reason, and an old link to /portal/analytics lands here too.

The account, in one line: status, plan, members, active API keys and your role. Plan, members and keys link to the page that changes them, when your role can open it.

Right now is refreshed every five seconds, with the age of what you are reading and a Refresh now beside it. If refreshing stops working a warning says so, because a page that has quietly stopped updating looks exactly like a healthy one.

Each panel says plainly when it has nothing: no calls yet, no latency samples yet. An empty panel is not the same as a healthy one. Right now appears for roles that can read the account's calls.

Over time is what the account's traffic did over a window you choose, and whether it went well. It is loaded when the page opens rather than refreshed, and it leaves out what Right now already shows: the call and error counts and the latency by stage are the same figures, and two copies of one count on one page disagree as soon as a call starts. It appears alongside Right now.

Every chart has a table one button away, with the numbers it is drawn from.

Under it, Team — the five members who signed in most recently — and Recent activity, the tail of the audit log. Each links to its full page.

For a super admin it is also the platform's front page, with four counts that are each a link: clients, suspended (nobody in them can sign in), without a member (created, never handed over) and users. Two counts would say how big the platform is; these say what needs doing.

Observe

Request log

Every API request this account made — requests, failed and the failure rate — and, in its own panel, recent failures. The failures panel is separate because a failure buried in a list of successes is a failure nobody finds.

With nothing wrong it says nothing has failed. This is the good outcome rather than showing an empty table you have to interpret.

Alerts

What the platform has raised about this account.

Call ratings

What callers thought, when they were asked.

Scores — average out of 5, responses, response rate as a share of completed calls, and promoters — beside what callers said.

On an account that has never collected one, the page explains how ratings arrive rather than showing an empty chart. An empty quality page reads as "nobody complained", which is not what it means.

Build

Dialer

A telephone in the portal: type a number, place a call, and hear it in the browser. On a call replaces the form while one is in flight.

The number is entered in two halves — a country and the national number — because that is what a person actually chooses and types. Pasting +44 20 7946 0958 is handled, so it is not dialled as an Indian number.

Style decides who takes the call:

Agent appears only for Custom — it is the one style that cannot work without it, and the other two have nothing to guess. With no agents built yet, it says so and points at Agents.

Use this to hear an agent before pointing a phone number at it.

Agents

The list, with bulk selection: select the agents shown, move to group, delete.

Recently deleted is a folded panel at the bottom with restore and delete for good. It is folded because it is a list of things somebody has already decided against, and absent entirely when it is empty. It is here rather than on a settings screen because the operator who deletes the wrong agent looks for it where the agents are.

Making a new agent

Start a new agent asks the shortest useful question first — who takes these calls? — and then how do you want to start?

Creating an agent hands over to the builder with the "which numbers reach it" dialog already open, because the form that made it no longer asks.

The agent builder

Eight tabs. Arrow keys move between them; on a phone the bar scrolls and the edges are marked when there is more.

Fields you are not allowed to change are locked rather than hidden, so the form is the same form for everybody. Where a value comes from a group it says so, with what it inherited.

On an agent that was built for you, editing a locked field says so in full rather than failing quietly: this agent was set up for you, so its <field> is not yours to change here — and then names what is: you can point numbers at it, choose the caller IDs and the carrier, and decide whether calls are recorded.

1. Agent — what it is and what it says

2. Languages — every language it speaks

One chip per language, the one calls open in marked as the default. Everything below the chips belongs to whichever chip is selected — you pick a language and then configure that language, rather than deciding for every field whether it means the default or one of the others.

Per language:

Plus, for the agent as a whole:

Which vendors appear in the per-language pickers depends on what the deployment has connected under Integrations. A vendor with no key is not offered.

3. Intelligence — the model and what it knows

A Voice engine card picks how the agent runs. If it is set to the realtime engine on a deployment with no realtime provider connected, the card says so in the error tone rather than letting you find out on a live call: calls to it will connect and then say nothing.

4. Calling — the telephone line

Below the tabs, the line itself:

5. Engine — how it listens, when it gives up, what it keeps

How it listens — the keypad menu:

Conversation:

Hang up when the conversation is finished — with when is it finished?, which is the condition it is judged against.

6. Tools — what it can reach mid-call

Tools this agent carries, laid out as a catalogue rather than one form, because the interesting decision is which kind of tool this is and each kind then needs a different half-dozen fields. One form covering all of them would show a calendar timezone to somebody configuring a transfer.

Every tool has these two, whatever its kind:

Calendar tools add:

Transfer call adds:

Custom function adds:

Paste the command takes a curl and fills the form in from it: method, URL, headers and body are read out, the values in the body become parameters, and anything that looks like a credential is lifted into the sealed half of the headers.

Secrets go out and never come back — a key field shows a hint and stays empty, and an unedited one is not re-sent, which is what makes changing a description possible without retyping a key.

Below the tools, transfer number is the agent-wide fallback. See functions.md.

7. Flow — the steps a call moves through

Per node:

Per edge:

Full reference: flows.md.

8. After the call — what is written down once it ends

Full reference: post-call.md.

Trying it

Three ways, offered according to what the agent is:

Any {{variables}} the agent expects are asked for first — the panel will not place a call with one missing. On a person-to-person line with no number, the two modes meet in the browser: this tab joins on one URL and whoever answers joins on the other.

Deleting

At the bottom, behind a typed confirmation.

Ideas

An idea is a script several agents share — the instructions, the greeting and the languages, and the voice, knowledge, tools and flow behind them — kept apart from the telephone, so one idea can run an inbound line, an outbound campaign and a web widget.

The list shows each idea as a tile: its greeting (or the start of its instructions), its languages, and the agents used by it, each a link to that agent. Search matches names, greetings, instructions and agent names. An account with no ideas sees the three steps instead.

New idea starts one in either of two ways:

• Write it — a name, an optional greeting, and the instructions.
• Copy an agent — copies an agent's instructions, languages, voice, knowledge, tools and flow into a new idea and moves that agent onto it, so nothing it says changes. Agents already on an idea are not offered.

Opening an idea edits its name, description, greeting and instructions — per language, when it speaks more than one. The save bar says how many agents a save reaches, and a refused save lists each field to fix. Used by links every agent on the idea; Also part of this idea summarises the model, knowledge, tools and flow, which are edited on any agent using it (saving there saves to the idea). An idea can be deleted only once no agent uses it.

An agent picks its idea on its Agent tab, under Idea, where the idea's name links back here. See personas.md.

Agent groups

Settings shared across a fleet of agents. Joining a group changes nothing on its own — see agent-groups.md.

New group: a name and a colour, picked from the server's palette so the page cannot offer one a save would refuse.

Inside a group:

Knowledge

The knowledge bases this account's agents may retrieve from.

Knowledge workspace names where all of this actually lives. Every account has exactly one workspace in the knowledge platform, created with the account and named after it, and its id is this account's id — so a document added on either side is answerable on both with nothing to sync. While the account exists that workspace cannot be deleted or suspended over there; deleting the account releases it. If the panel warns that the knowledge platform does not have the workspace marked as this account's, say so: it means somebody there could remove it, and agents would keep answering and quietly stop citing documents.

New knowledge base creates one. Already in the knowledge platform lists corpora that exist on the knowledge platform but have no row here — almost always somebody who built one over there and came here looking for it. Add adopts it: its documents are already indexed, so agents can use it immediately.

Inside one, add a document:

Plus the Documents list. Full behaviour: knowledge-base.md.

Phone numbers

Whether this account may bring a number of its own is decided by the same rule that would refuse the save, so the form never offers a control that is going to be turned down.

Campaigns

Run a journey or an agent over a list of contacts.

New campaign:

The list carries search, bulk selection, and per-campaign add contacts.

A running campaign reports as it goes. Contacts outside the recipient's local calling window are marked as such — they are dialled when it opens, not dropped. Read compliance.md before running one.

Journeys

Multi-step automation across many calls and days: call, branch on the outcome, wait, retry, fall back to a message.

New journey takes a name. Inside, the definition — nodes and edges — on a canvas: click a box to edit it, drag from a box's right edge onto another to connect them, drag the background to pan, scroll to zoom. A This journey panel beside it counts the nodes, names what calls start on, and counts the problems.

A separate panel lists things to fix before publishing, so a draft cannot be published into a state that would fail on a real contact.

Per node, depending on its kind:

Put one contact through takes a single E.164 number — +919000000000 — and runs the journey against it. The field says plainly that this places real calls.

Full reference: journeys.md.

Calls

Every call, with a detail drawer.

The filter controls only appear once there is a first call, so a new account meets a list rather than a toolbar.

Tiles: Calls, Talk time, Answered, Turns, Recorded.

A row marks whether it has a recording and which digits the caller pressed, in order. Opening one gives the transcript, then What was said — the post-call summary and the extracted fields, stamped with when the analysis ran — and the call id with a copy button. That id is the thing to quote in a support ticket.

Money

Projects

Cost centres inside the account: what work is attributed to, with a monthly budget and a decision about what going over does.

Cost centres lists them. Each has a name, a description, a colour — which is what the dot beside a row in every other table is drawn from — and a monthly budget. Each can be edited, and deleted behind its own confirmation.

One row is marked · default: the project everything unfiled is attributed to. It has no Delete button and cannot be archived, because a control that only ever refuses is worse than no control. Make default on any other row hands it the marker, which is also how the current default is freed to be deleted — nothing is re-attributed, and the old project keeps everything it has already cost.

Work that names no project shows as Unassigned rather than being hidden. See projects.md.

Usage

Each panel names its own empty state — no calls in this window yet is a different statement from no calls recorded yet, and the page keeps them apart.

Billing

At the top, the balance as arithmetic: what was granted, what has been spent, and tokens remaining — with that last figure also expressed as ≈ N minutes and about N days, since a token count is not something anybody can plan around.

The page recommends a plan when it should, and says which of two reasons it is: the account has outgrown this plan and the exceeded limits are in red, or at this volume another plan would simply cost less. Those are different arguments and it does not blur them.

Owner only.

The controls a super admin also sees

Four more cards appear on this page for whoever operates the platform.

Access

Team

Invite someone — an address and a role. Invite a team takes several at once. An address that already had an account is added straight away and says already had an account — added, rather than sending an invitation nobody needs.

Project access decides which cost centres one member may reach: every project, or only these. An owner or admin reaches every project by role, so on their rows the control is said rather than simply not offered — a missing control reads as a bug. An account with no projects yet says so instead of offering an empty picker.

What the roles mean sits under the table: each role with the sentence describing it, so the picker is not a question you cannot answer.

API keys

Create an API key:

The secret is shown once, on a panel that says so. Revoke from the list. An account with none says no keys yet.

On a platform login with no account selected the page says choose a client account first, because a key belongs to an account and there is nothing to mint one against. See authentication.md.

Webhooks

A name (Zendesk ticket sync), an endpoint (https://example.com/webhooks/voiceai), and which events it wants — everything, or only these. Creating one shows a signing secret, once.

Deliveries lists what was sent and what came back, which is where a webhook that "never fires" is actually diagnosed. Deleting one asks first.

As with keys, a platform login with no account selected says choose a client account first. See webhooks.md.

Audit

Who did what.

Filtered three ways: free text, and by area — the prefix of the action, client, user, key — which is the only grouping the log has and the one people read it by: what did we do to accounts this week. A super admin also gets a platform-wide scope.

Platform

Super admin only. The server refuses these to everyone else regardless of what the browser renders.

Clients

Every client account.

Create a client takes a name and a plan. The list filters by name, slug or plan, and marks:

• suspended — nobody in these accounts can sign in.
• no owner — nobody can sign in to this account; invite an owner.

Inside one: Settings, Plan, Activity, its members and its API keys, and a danger zone with a permanent delete behind a typed confirmation. An account nobody has been added to says nobody has access to this client yet, and one with no keys says no keys — both of which are states worth seeing rather than blank space.

Creating an invitation from here reports invitation created.

Announcements

What the portal says to customers.

Bump the revision shows it again to people who had closed it.

Users

Every person on the platform, across every account.

Create a user makes one directly, rather than by invitation. Filter by email or name.

Each row marks whether they are a super admin — full access to every client account — or reach only the accounts they are a member of, and whether they cannot sign in.

Row actions: disable — signs them out everywhere and blocks the next sign-in, reversible — and grant super admin.

Pricing

What a token costs, and what a plan costs.

Reset to shipped pricing puts the defaults back. Only a platform administrator can see this page at all — the note on it says so.

Integrations

Every external service this deployment can reach, on one page, in the order a deployment is set up — because the call has to reach you first:

Telephony · LLM · TTS · STT · Knowledge · Notifications

One card per vendor, connected or not, with its models on it, and a filter box over them. A vendor with no credentials reads not connected; a deployment that can reach nothing at all says nothing can be connected yet.

Nobody types a model in. Which models a vendor publishes is a fact about the vendor rather than a preference, so connecting one offers everything this build knows it serves, and disconnecting takes it back out. There is no half-filled state in between.

Connected means in service. A vendor with the credentials it needs serves calls; removing the key is how you take it out. A row disabled by the old switch shows as paused with the one button that fixes it, rather than being quietly dropped from the chain forever.

What this page decides is which vendors are reachable and which of their models are on offer. Which model actually answers is decided on the agent, every time — no card here carries a fallback, because the words a caller hears must not change when a super admin edits a credential on a page the person who built the agent has never opened.

Product feedback

What customers have sent, via the topbar's Feedback button.

Your account

The operator console

A separate site for the Operator role: a telephone on a screen, and specifically the telephone everybody already owns.

Sign in, type a number, press call, talk; when somebody rings, pick up. That is the whole application. There is no agent, no prompt, no model, no voice, no knowledge base, no group, no campaign and no settings page — not because they are hidden from the role, but because a person whose whole working day is this screen should not have to look past a keypad to find the keypad.

The layout is a mobile dialer's on purpose: a number at the top, a 4×3 grid of round keys with the letters under the digits, a round green call button, and a tab bar switching between the keypad and the calls you have had. A call takes the whole screen, as it does on a phone.

* and # are on the pad because a keypad without them is not a keypad anybody recognises. They are live only where they mean something — on a call, navigating somebody else's phone menu — and on the dial screen they say why they are not, rather than sitting there dead.

Everything it can ask for is re-authorized on the server against the session cookie, and the operator role refuses every write in the product.

When something looks wrong

Quote the call id — copyable from any call — and the account name in a support ticket. Your deployment serves its own support page at /docs/support, which names the two identifiers that let us find your call in seconds.