SIP Integration

Integrate Kallglot with your existing PBX, contact center, or telephony infrastructure using standard SIP protocols.

Preview: Direct SIP/PBX translation is currently available for approved enterprise pilots and is not yet generally available. This guide targets engineering partners working with the Kallglot team.

Prerequisites

A SIP-capable PBX or SBC
Network connectivity between your infrastructure and sip.kallglot.com (follow your TLS/TCP profile and firewall rules)
A Kallglot API key (for programmatic session workflows)
Developer Portal SIP settings configured (Telephony → SIP / PBX)

Architecture

At a high level, your PBX sends SIP signaling to Kallglot’s SIP endpoint and exchanges audio while Kallglot performs real-time translation and related voice features. Credential checks, optional IP filtering, TLS/SRTP preferences, concurrency limits, and session defaults configured in the Developer Portal are applied when SIP calls authenticate. Two common integration patterns:

API-controlled SIP sessions (advanced) — Your backend calls POST https://api.kallglot.com/v1/sessions with routing.type: "sip" and routes the SIP leg to sip:<session_id>@sip.kallglot.com. This is an advanced, engineering-led flow for partners—not the ordinary self-serve PBX setup.
Inbound-first — Kallglot may authenticate the SIP trunk and associate or create session context consistent with your policy; specifics depend on your routing and numbering plan—validate with support@kallglot.com if you rely on unattended ingress.

Outbound calling initiated through the API may use SIP trunks your account is provisioned for; availability and configuration are account-specific.

Setup Steps

1. Configure SIP Credentials

Create your developer account at kallglot.com, then in the Developer Portal:

Go to Telephony > SIP / PBX and click Configure SIP
Enable SIP access using the toggle
Note your automatically generated credentials:
- Username: Your unique SIP username
- Domain: sip.kallglot.com
Configure security:
- Add your PBX IP addresses to the IP Allowlist (recommended)
- Click Regenerate Password to create new credentials if needed
Copy your password when prompted (shown only once)

In the same SIP configuration modal, open Advanced Settings (collapsible section) to manage TLS/SRTP requirements, session defaults, region, default languages, and concurrent call limits. Those values are saved with your organization and applied when SIP calls are authenticated.

2. API-controlled sessions (advanced)

This step is an advanced flow for engineering-led integrations that create each translated call from server code. For an enterprise pilot with our integration team, the SIP credentials and PBX routing below are the path — reach out via the button on the SIP page rather than building a session-control service first. Before routing a call to Kallglot over the API, create a session:

Kallglot does not currently provide official SDKs. Helper functions like createKallglotSession(...) and endKallglotSession(...) in this guide are thin wrappers around the HTTP API.

async function createSIPSession(callerInfo) {
  const response = await fetch('https://api.kallglot.com/v1/sessions', {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${process.env.KALLGLOT_API_KEY}`,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      mode: 'bidirectional_translation',
      source_language: 'de',
      target_language: 'en',
      routing: {
        type: 'sip'
      },
      metadata: {
        caller_id: callerInfo.callerId,
        pbx_call_id: callerInfo.pbxCallId
      }
    })
  });

  const session = await response.json();

  // The SIP URI to route the call to:
  const sipUri = `sip:${session.id}@sip.kallglot.com`;

  return { session, sipUri };
}

3. Configure Your PBX

Route calls to the Kallglot SIP endpoint. Configuration varies by PBX:

Asterisk

; sip.conf
[kallglot]
type=peer
host=sip.kallglot.com
port=5061
transport=tls
username=your_sip_username
secret=your_sip_password
fromdomain=sip.kallglot.com
qualify=yes
disallow=all
allow=opus
allow=g722
allow=ulaw
allow=alaw

; extensions.conf
[translated-calls]
exten => _X.,1,Dial(SIP/kallglot/${SESSION_ID})

Example: SIP gateway (XML)

The following illustrates a minimal SIP gateway XML snippet—the exact layout depends on your PBX vendor.

<!-- SIP gateway registration block (syntax varies by vendor) -->
<gateway name="kallglot">
  <param name="username" value="your_sip_username"/>
  <param name="password" value="your_sip_password"/>
  <param name="realm" value="sip.kallglot.com"/>
  <param name="proxy" value="sip.kallglot.com"/>
  <param name="register" value="false"/>
  <param name="caller-id-in-from" value="true"/>
</gateway>

<!-- dialplan -->
<extension name="translated_call">
  <condition field="destination_number" expression="^(\d+)$">
    <action application="bridge" data="sofia/gateway/kallglot/${SESSION_ID}@sip.kallglot.com"/>
  </condition>
</extension>

Cisco CUCM

Add a SIP Trunk:
- Destination Address: sip.kallglot.com
- Port: 5061
- Transport Type: TLS
Configure SIP Security Profile with digest authentication
Create a Route Pattern pointing to the trunk

4. Handle Call Flow

Typical call flow with session management:

// When a call comes in to your PBX
app.post('/pbx/incoming', async (req, res) => {
  const { callId, from, to } = req.body;

  // 1. Create Kallglot session
  const { session, sipUri } = await createSIPSession({
    callerId: from,
    pbxCallId: callId
  });

  // 2. Store mapping
  await db.callMappings.insert({
    pbx_call_id: callId,
    kallglot_session_id: session.id
  });

  // 3. Return SIP URI for PBX to route to
  res.json({
    action: 'route',
    destination: sipUri
  });
});

// When call ends
app.post('/pbx/hangup', async (req, res) => {
  const { callId } = req.body;

  // Find and end Kallglot session
  const mapping = await db.callMappings.findOne({ pbx_call_id: callId });
  if (mapping) {
    await endKallglotSession(mapping.kallglot_session_id);
  }

  res.status(200).send('OK');
});

SIP Configuration Options

Transport

Transport	Port	Description
TLS	5061	Encrypted signaling (recommended for production)
TCP	5060	Unencrypted, reliable delivery
UDP	5060	Unencrypted, standard SIP

Default: TLS is enabled by default. Configure allowed transports in Advanced Settings.

Codecs

Kallglot recommends the following audio codecs for SIP calls:

Codec	Sample Rate	Bandwidth	Description
Opus	Variable	Variable	Best quality, modern systems
G.722	16 kHz	64 kbps	Wideband, HD voice
G.711 PCMU	8 kHz	64 kbps	µ-law (North America)
G.711 PCMA	8 kHz	64 kbps	A-law (International)

Recommended defaults: Opus, G.722, PCMU, and PCMA are enabled by default for new configurations. G.729 is not supported for translated calls. Narrowband/compressed audio can materially reduce speech-recognition quality, so G.729 is not offered or recommended. If a caller offers no codec Kallglot accepts for translation, the SIP edge rejects the call rather than silently falling back to an unsupported codec. Developer Portal: Under Configure SIP → Advanced Settings, select Allowed audio codecs (preference order follows the checklist top to bottom when multiple codecs are selected). Require TLS / Require SRTP complement those lists—for borderline interoperability questions, email support@kallglot.com.

DTMF

DTMF relay behavior depends on the negotiated media path and telephony relay; Kallglot does not interpret DTMF digits as session control inputs today.

Security

TLS Configuration

Always use TLS for SIP signaling (port 5061) in production. Turn on Require TLS in the Developer Portal so connections that do not meet your policy can be rejected:

Go to Telephony > SIP / PBX → Configure SIP → Advanced Settings
Enable Require TLS
Your PBX must support TLS 1.2 or higher

# Verify TLS connectivity
openssl s_client -connect sip.kallglot.com:5061 -tls1_2

IP Allowlisting

Restrict which IPs can authenticate as your SIP trunk:

Go to Developer Portal > Telephony > SIP / PBX
Click Configure SIP
Add your PBX egress IPs to the IP Allowlist (one per line; CIDR supported)

Behavior: If the allowlist is empty, Kallglot does not apply source-IP filtering (authenticate attempts still require valid credentials). After you add one or more entries, only those networks are accepted. For production, populate the allowlist.

SRTP for Media

Require encrypted RTP when your policy demands it:

Go to Developer Portal > Telephony > SIP / PBX → Configure SIP → Advanced Settings
Enable Require SRTP — connections that do not complete SRTP negotiation where required may be rejected (your PBX must negotiate SRTP successfully when this is on)
Align crypto suites and RTP/SRTP profiles with your PBX vendor’s documentation; if media fails to establish, collect SIP traces from your environment and work with support@kallglot.com alongside your telephony team.

Advanced Scenarios

The following advanced features are on our roadmap. Contact support@kallglot.com for early access or to discuss your requirements.

SIP REFER for Transfers (Coming Soon)

Call transfer support via SIP REFER is planned for a future release. Currently, to transfer a call:

End the current Kallglot session
Create a new session for the transfer target
Route the call to the new session URI

Multiple Participants (Coming Soon)

Conference call translation support is planned. Currently, Kallglot supports two-party calls (agent + customer).

Regional Processing

The processing region is configured in the Developer Portal:

Go to Telephony > SIP / PBX > Configure SIP
Under Session Defaults, the Region is Europe (EU).

At this time only Europe (EU) is available. US and Asia-Pacific (AP) are not currently available for SIP. The SIP endpoint is the same in all cases for future regions: sip.kallglot.com

Troubleshooting

Registration Issues

# Test SIP connectivity
sipsak -s sip:test@sip.kallglot.com -v

# Check firewall allows SIP traffic
nc -zv sip.kallglot.com 5061

No Audio

Check NAT configuration - ensure RTP ports are open
Verify SRTP settings match on both sides
Check codec negotiation in SIP logs

Call Quality Issues

Monitor jitter and packet loss
Check network latency to Kallglot
Ensure your region setting matches your network topology

Debugging

For SIP debugging, check:

Developer Portal > API Logs — recent integration activity (for example webhook delivery attempts). It is not a full SIP signaling trace viewer.
Your PBX / SBC logs — SIP dialogs, SDP, RTP/SRTP negotiation.
Kallglot support — for authentication or routing issues that need correlation across both environments after you share traces from your side.

# Test SIP connectivity from your PBX
sipsak -s sip:test@sip.kallglot.com -v

# Verify TLS handshake
openssl s_client -connect sip.kallglot.com:5061

Best Practices

Secure the signaling and media path

TLS is the expected signaling transport for production. SRTP is recommended, and is enforced when the configured policy sets Require SRTP. Plan your PBX/SRTP alignment before go-live.

Implement proper failover

Configure your PBX with failover to handle Kallglot outages gracefully.

Monitor call quality

Set up monitoring for RTP quality metrics (MOS, jitter, packet loss).

Pre-creating sessions to reduce call-setup latency is an optimization that only applies to advanced API-controlled integrations (described under Setup). It is not part of the standard enterprise PBX pilot flow.

Security Hardening

Production Security Checklist

Complete these security measures before deploying SIP integration to production.

Requirement	Description	Priority
TLS 1.2+	Use port 5061 with TLS for SIP signaling aligned with policy	Required (production expectation)
IP Allowlist	Enter allowed source IPs in Configure SIP (empty allowlist = no IP filtering)	Strongly recommended for production
Strong Credentials	Use generated credentials, never default passwords	Required
Credential Rotation	Rotate SIP credentials every 90 days	Recommended
SRTP	Enable SRTP for encrypted media streams	Recommended
Private Network	Use VPN or private connectivity where possible	Recommended

Credential Security

SIP credentials should be treated as sensitive secrets. Store them securely and never commit them to version control.

// Good: Load credentials from environment
const sipConfig = {
  username: process.env.KALLGLOT_SIP_USERNAME,
  password: process.env.KALLGLOT_SIP_PASSWORD,
  domain: 'sip.kallglot.com'
};

// Bad: Never hardcode credentials
// const sipConfig = {
//   username: 'sip_abc123',
//   password: 'hardcoded-password'  // SECURITY RISK
// };

Network Security

Configure your firewall to allow only the required traffic:

Protocol	Port	Direction	Purpose
TCP	5061	Outbound	SIP TLS signaling
UDP	20000-20100	Both	RTP media (example sizing; tune for your concurrency)

Block traffic you do not need; widen media port ranges as your concurrent call volume grows.

Contracts, compliance, and data handling

Legal terms, questionnaires, DPIAs, and certifications (SOC 2, GDPR, HIPAA, etc.) are covered by your agreement and collateral from Kallglot—not this SIP how-to. For SIP specifically: SIP credentials appear once in the portal after create/rotate—store them like any production secret. Processing region in SIP Session Defaults is Europe (EU) and is the only option available today. Confirm suitability with your legal team if you have residency requirements—support@kallglot.com for paperwork.

Policy Configuration

Session Defaults

Configurable in Telephony > SIP / PBX → Configure SIP → Advanced Settings:

Setting	Options	Default
Session Mode	Bidirectional Translation	Bidirectional Translation
Region	Europe (EU)	EU
Default Source Language	Concrete ISO code (e.g. `en`), or `auto` only when the target is pinned	`auto` (not usable to enable)
Default Target Language	Concrete ISO code (e.g. `de`), or `auto` only when the source is pinned	`auto` (not usable to enable)
Max Concurrent Calls	1–100	5

Auto-detect is not enable-ready on its own. To enable SIP, at least one of the source or target languages must be a concrete language. auto on both sides is stored as the initial default but is rejected when you enable SIP — pin a usable pair first. Only Europe (EU) is available today.

Concurrency limits are part of your policy; treat them as operational and contractual limits for your plan.

Transport and media policy flags

Require TLS and Require SRTP in Advanced Settings reinforce transport security alongside the Allowed signaling transports and Allowed audio codecs sections. Escalations or exotic PBX interoperability needs → support@kallglot.com.

Quick Reference

Server:     sip.kallglot.com
TLS Port:   5061
UDP/TCP:    5060
Codecs:     Opus, G.722, PCMU, PCMA (G.729 not offered)
Transport:  TLS (recommended)

Operations checklist

Ship with basic observability:

Invite / setup latency — alert if PSTN callers hear long silence before audio.
Your PBX counters — failed registrations, 401/403, RTP timeouts vs baseline.
Concurrent calls vs portal cap — avoid hitting organizational limits mid-day.
Developer Portal API Logs — correlates webhook/API failures; deeper SIP traces live on your SBC.

Escalations with PCAP from your edge + timestamps → support@kallglot.com.

​SIP Integration

​Prerequisites

​Architecture

​Setup Steps

​1. Configure SIP Credentials

​2. API-controlled sessions (advanced)

​3. Configure Your PBX

​Asterisk

​Example: SIP gateway (XML)

​Cisco CUCM

​4. Handle Call Flow

​SIP Configuration Options

​Transport

​Codecs

​DTMF

​Security

​TLS Configuration

​IP Allowlisting

​SRTP for Media

​Advanced Scenarios

​SIP REFER for Transfers (Coming Soon)

​Multiple Participants (Coming Soon)

​Regional Processing

​Troubleshooting

​Registration Issues

​No Audio

​Call Quality Issues

​Debugging

​Best Practices

​Security Hardening

​Production Security Checklist

​Credential Security

​Network Security

​Contracts, compliance, and data handling

​Policy Configuration

​Session Defaults

​Transport and media policy flags

​Quick Reference

​Operations checklist

SIP Integration

Prerequisites

Architecture

Setup Steps

1. Configure SIP Credentials

2. API-controlled sessions (advanced)

3. Configure Your PBX

Asterisk

Example: SIP gateway (XML)

Cisco CUCM

4. Handle Call Flow

SIP Configuration Options

Transport

Codecs

DTMF

Security

TLS Configuration

IP Allowlisting

SRTP for Media

Advanced Scenarios

SIP REFER for Transfers (Coming Soon)

Multiple Participants (Coming Soon)

Regional Processing

Troubleshooting

Registration Issues

No Audio

Call Quality Issues

Debugging

Best Practices

Security Hardening

Production Security Checklist

Credential Security

Network Security

Contracts, compliance, and data handling

Policy Configuration

Session Defaults

Transport and media policy flags

Quick Reference

Operations checklist