How 3CX v20 changes phone-system automation in the AI era
The Call Control API was rewritten. The Configuration API (XAPI) is brand new. Here is what AI agents, SaaS connectors and custom integrations can now do directly against the PBX.
3CX v20 quietly turned the phone system into something AI builders can talk to directly. The v20 REST API (also called XAPI) is new in this major version, and the Call Control API has been rewritten to be async and transactional. Put together, the 3CX v20 API surface now covers user provisioning, queue management, presence, recordings, and live call control through documented HTTP endpoints. For anyone wiring an AI agent or a SaaS connector into a phone system in 2026, that matters.
This article walks through what actually changed between v18 and v20, why API maturation lines up with the AI wave, what the endpoints expose today, and what still needs a server-side helper.
TL;DR
- 3CX v18 (2021) shipped a Call Control API and a limited config interface. v20 (2024) introduced the OData-based Configuration API (XAPI) and rewrote Call Control to be transactional and asynchronous.
- The current surface covers users, queues, departments, system extensions, call control, presence and recordings, gated by Enterprise licence tiers (8SC+).
- AI agents and SaaS connectors can drive 3CX directly for routing, dialling and analytics. Multi-tenant fan-out, retry logic and CRM-side persistence still belong in a server-side integration layer like Connect Zero.
What changed between 3CX v18 and v20
3CX v18 went GA in August 2021 and included the first generation of the Call Control API. That release let developers initiate, answer, transfer and terminate calls programmatically, but it required call-state tracking on the client side. State machines had to be hand-rolled, and developers were responsible for stitching intermediate events back into a coherent view of a call leg.
v20 (released through 2024 and matured across updates 1 through 9) rewrote the Call Control API for Linux first, with Windows following behind. The new implementation is asynchronous and awaitable: requests return the final result of the action rather than a stream of intermediate states. 3CX's own description is that it has become transactional, so the developer asks for an action and gets the resolved outcome.
The second large change is the Configuration API, branded XAPI. This is new in v20 and did not exist as a documented surface in v18. It is a RESTful Web API built on the OData protocol with OpenAPI specifications, and it covers nearly every administrative configuration option that the 3CX admin console exposes.
Three years between releases, but the API story changed completely.
So the honest framing is: v20 is not "3CX finally has APIs". It is "3CX expanded what was a narrow call-control surface into a documented, OData-shaped REST API that covers the rest of the system". That is a bigger change than a marketing line about new endpoints would suggest.
Why API maturation matters now for AI
The AI wave changed what an integration is. In 2023 an integration meant a CRM that pulled a contact when the phone rang. In 2026 an integration means an LLM agent that listens to the call in real time, looks up history, drafts a follow-up, schedules a callback, and updates a deal record. That agent needs an API to push and pull from.
Two things have to be true for an AI agent to do useful work against a phone system. First, it needs read access to system state: who the user is, which queue the call landed in, what the agent's presence is, where the recording lives. Second, it needs write access to take action: route a call, change presence, create a user, fire a callback. Until v20, the second category was thin and the first category required scraping or undocumented endpoints.
v20 fixes both. The XAPI gives an AI agent a structured way to query the system, and the rewritten Call Control API gives it a clean way to act. Combined with WebSocket event delivery for real-time call state, that is enough surface for an agent to operate on the PBX without a human in the loop.
The timing is not coincidence. Vendors across the unified communications space spent 2024 and 2025 racing to be the "AI-ready" PBX. 3CX's response was to ship the API layer that makes third-party AI tooling viable, rather than locking customers into a single AI vendor.
What the v20 API actually exposes
The Configuration API (XAPI) lives at /xapi/v1/ on the 3CX FQDN and serves a Swagger definition at /xapi/v1/swagger.yaml. Endpoint categories that are documented or community-confirmed:
- Users: list, create, update, delete; fields include Id, FirstName, LastName, Number, EmailAddress, department membership and role bindings
- Queues: manage queue configuration, with expand parameters for Agents, Groups and Managers
- Departments: create and manage organisational structure
- System extensions: IVR, ring groups, conferences, virtual extensions
- Call routing: inbound and outbound rules
- Trunks: SIP trunk configuration
- Reports and CDR: call history queries (expanded in Update 6 with the CDR rewrite and Grafana dashboards)
The Call Control API covers the live-call surface. It runs as an application installed on the 3CX instance itself, exposes REST endpoints under /callcontrol/, and pairs with a WebSocket channel for event delivery. Typical actions include:
POST /callcontrol/{ext}/devices/{deviceId}/makecall: initiate a call from a specific device- Device discovery per user
- Real-time call state via WebSocket subscription
Authentication is OAuth2 client credentials. Two token types matter: Multi-Company Admin Tokens for full system access, and User Tokens scoped to a single user's roles and department permissions. The licence gate is real: Call Control needs 8SC+ Enterprise, and Configuration API access needs an 8SC and higher AI licence tier. Worth flagging this early in any 3CX licence planning conversation.
Patterns that become possible
A few integration patterns move from "possible with a partner" to "possible directly" with the v20 surface:
AI-triggered call routing. An agent watching a queue can read live call metadata, decide based on caller history or intent, and reroute the call without needing a 3CX-side IVR change. Update 9 adds AI routing based on topics natively, but the XAPI also lets external agents do the same job with their own logic.
Real-time transcription pipelines. Once the Call Control WebSocket pushes a call-answered event, an external service can pull the recording or stream audio, transcribe it, and post structured summaries back to a CRM. Update 7's AWS S3 export and MySQL/MSSQL logging make the recording side simpler.
A four-stage pipeline that didn't exist on v18.
Voice agents talking to 3CX directly. Newer OpenAI Realtime models (gpt-realtime-1.5 referenced in Update 9 alpha) can hold a conversation while making tool calls. With the v20 API as a tool surface, a voice agent can place a call, transfer to a human, or look up a queue's status mid-conversation.
Custom CRM and provisioning integrations. User onboarding flows can now create 3CX extensions programmatically rather than through manual admin work. This is the pattern Connect Zero uses for automated 3CX setup inside CRM environments.
What still requires server-side or partner integration
The v20 API surface is wide, but it is not a complete replacement for an integration layer. Several jobs still live outside the PBX:
- Multi-tenant fan-out. XAPI scopes to one 3CX instance. If a SaaS connector needs to drive 50 customer PBXs, the orchestration, credential vault and rate limiting belong in middleware.
- Retry and idempotency. The Call Control API is transactional now, but the rest of the surface still expects the caller to handle transient errors and replay safely.
- CRM-side data shaping. Pulling a CDR row is one HTTP call. Mapping that row to the right CRM contact, normalising phone numbers, attaching the recording as a media object and updating the deal pipeline is a different problem.
- Webhook delivery to CRMs. 3CX can POST to a single URL on a call event. Routing those events to different tenant endpoints, signing them, and replaying failures is integration-layer work.
- Licence enforcement. Both the Configuration API and parts of the Call Control surface need Enterprise or AI tier licences; an integration layer is where licence checks and graceful degradation belong.
Connect Zero exists precisely because of this gap. The PBX exposes the primitives. The integration layer turns them into a working multi-tenant product. See how Connect Zero handles the 3CX side for a concrete picture.
Common questions
When did 3CX release its first public API?
3CX v18 (released August 2021) shipped the first documented Call Control API. v20 added the OData-based Configuration API (XAPI) and rewrote Call Control to be transactional. Earlier versions had internal APIs that were not widely supported for third-party use.
Do I need a specific 3CX licence to use the v20 API?
Yes. The Call Control API requires an 8SC+ Enterprise licence. The Configuration API requires an 8SC and higher AI tier licence. Standard and Pro tiers do not include API access.
Is the v20 API documented?
Yes. Each 3CX v20 instance serves an OpenAPI definition at /xapi/v1/swagger.yaml. The Call Control API has its own documentation set, and 3CX maintains a public xapi-tutorial repository on GitHub.
Can an AI agent place calls through 3CX v20?
Yes, through the Call Control API's makecall endpoint, provided the agent authenticates with OAuth2 client credentials and the target user is on an 8SC+ Enterprise licence.
Where does Connect Zero fit if 3CX has its own APIs now?
3CX exposes the primitives. Connect Zero handles the multi-tenant orchestration, CRM-side data shaping, webhook delivery and licence-aware fallbacks that a per-customer integration would otherwise have to rebuild. See the features list for the full breakdown.
See 3CX ConnectZero.
The integration layer that turns the v20 API into a working multi-tenant product. Calls in your CRM in under ten seconds, with the recording attached.
