Changelog

​

API keys

• Personal API keys (kbp_live_…) act as the teammate who made them, are logged under their name, are capped by their current role, and stop when they leave. Workspace keys (kb_live_…) stay for automations. See Authentication.
• Whispering, listening in, taking over, call notes, and number and minute requests need a personal key (403 personal_key_required otherwise).
• Transfers through the API. Workspace keys can transfer a live call to the agent’s configured destinations; transferring to a typed number needs a personal key.
• IP allowlist in Settings → API keys → Allowed IP addresses, up to 20 entries.
• Roll now keeps the old key working for 24 hours.

​

Calls

• Browser web calls with no server relay. Your server creates a session with allowed_origin; the browser connects with the single-use grant through /client/offer. See Web calls.

​

API conventions

• One pagination style everywhere: limit and cursor in, data, next_cursor and has_more out.
• Idempotency-Key is required on every create and action POST.
• Dated API versions with the optional Kallabot-Version: 2026-11-07 header, echoed on every response. See Versioning.
• New error codes: personal_key_required, key_owner_inactive, invalid_webcall_origin, unsupported_api_version, sdk_version_unsupported.
• Webhook events reference: all 35 events now have their own pages in the API reference.
• Knowledge sources can be added, edited and deleted through the API. See Knowledge.

​

Billing

​

SDKs

​

The new Kallabot

• A six-step agent builder (Identity, Voice, Instructions, Knowledge, Tools, Channels) with a live preview, templates and duplication.
• Around 50 languages with regional dialects, including Emirati, Saudi, Egyptian and other Arabic dialects, and callers who switch language mid-sentence.
• Natural turn-taking: the agent waits until callers have finished, can be interrupted, and backchannels while they talk.
• Voice cloning in the voice lab.
• Drafts, publishing and version history with one-click restore.

• Phone numbers in many countries, number forwarding, number porting, and bring-your-own carrier or office phone system over SIP.
• Number verification for countries that require it, and caller trust (signed calls, caller name, spam check registration, number health).
• WhatsApp through Meta Embedded Signup, including numbers that stay on the WhatsApp Business app, with message templates and a full studio.
• Messenger and Instagram, with comment-to-DM and story mention replies.
• A web chat widget with a visual studio, voice, and a one-line install.

• One inbox for WhatsApp, Instagram, Messenger and web chat, with take-over, hand-back, notes, quick replies and bookings.
• Calls with recordings, transcripts, summaries, saved views and CSV export.
• A live console to listen in, whisper to the agent, take over or transfer.
• Voicemail detection for outbound calls, scheduled calls and confirmable call-backs.
• Live analytics across every channel, with weekly emails and share links.
• Roles, branches, minutes per person and an audit log.

• A new public API at https://api.kallabot.com/v1, generated into a full API reference.
• Scoped API keys in the format kb_live_…, with expiry, instant revocation and per-key access presets.
• RFC 9457 problem responses with stable error codes, required Idempotency-Key on creates, If-Match revisions, cursor pagination and per-key rate limits with RateLimit-* headers.
• Signed webhooks following Standard Webhooks, with a catalogue of 35 events, automatic retries, delivery logs, replay and secret rotation with a grace period.
• Browser voice calls over WebRTC.