The call test lets a public web page place one real call through the platform and report back whether audio flowed in both directions and how good it was. The browser provisions a disposable WebRTC SIP phone, registers it, dials a number that plays a recording and hangs up, then hands the phone back and asks for the measured result.

Three of these four endpoints are unauthenticated. They are called by anonymous browsers. What makes that acceptable is not a token:

• Nothing in a request selects a target. Customer, extension and test number all come from server

configuration - there is no request field that can be pointed at another customer.

• The credentials land on an extension whose outbound.destinations is GOTO, which confines

it to a single dialplan item - every dialled number, every star code and 112 alike.

• The session token is a random 128-bit value, not the phone's id, so one visitor cannot act on

another's session.

• At most 50 test phones exist at once and each lives at most 5 minutes.

The design document lives in the tcx-pbx-asterisk2 repository at docs/superpowers/specs/2026-09-02-pbx-call-test-design.md; its section 6 is the full containment argument and should be read before changing any of these endpoints.

The only key this feature adds is callTest:<session-token>.