API : PBX : Self-service page for callers

This page describes how a customer can build a page on its own website where a caller - a third party whose calls have been recorded - can revoke their consent and have the recordings they are part of deleted, without contacting the customer. TelecomX does not host such a page; it is built by the customer (the data controller) with the API.

See also Datatilsynet's guidance Optagelse af telefonsamtaler for what a caller must be told and may ask for.

1. The caller enters their phone number on the page.
2. The page verifies that the caller owns the number - typically by sending a one-time code by SMS and asking for it back. Without this step anybody could delete anybody's recordings. Limit the number of codes per number and per IP address, expire codes after a few minutes and allow only a few attempts per code.
3. With the number verified, the page lists the caller's consent records: GET /pbx/recordingconsent/records?customer=CUSTOMER_ID&callerNumber=NUMBER. Numbers are stored as the PBX received them, normally without a leading + (e.g. 4512345678) - look up the formats your callers arrive with.
4. For each record the caller can choose:
   • Revoke consent from today - POST /pbx/recordingconsent/records/RECORD_ID/invalidate without a body. The caller is asked for consent again on the next call; recordings already made are kept until their retention period ends.
   • Revoke consent and delete all recordings made on it - the same request with the body { “deleteRecordings”: true }. Offer a clear “Are you sure?” step - the deletion cannot be undone.
5. Show the caller the result, and keep your own log of the request (who, when, which records) - the consent records themselves keep revokedAt, recordingsDeletedAt and recordingsDeleted.

The list of recordings made on a record (GET /pbx/recordingconsent/records/RECORD_ID/recordings) can be shown before the caller confirms - it returns date and length, not the content.

Recordings made while consent is not required (or under the local call policy) are not linked to a consent record. To delete those, find them with the free-text filter of the recording list (it matches the caller and callee number) and delete them one by one with Delete recording. Personal recordings can only be listed and deleted by the employee who owns them.

• The page's backend calls the API with a TelecomX user token of an employee with MANAGER access to the customer - revoking and deleting require MANAGER.
• Never put the token in the browser or in client-side code. The browser talks to your backend only; your backend checks the verified phone number and only acts on records whose callerNumber is that number.
• Use a dedicated employee for the integration, so its actions are recognisable in the change log.

# 1. After the SMS code check: the caller's records
GET https://api.telecomx.dk/pbx/recordingconsent/records?customer=12345678901234567890ABCD&callerNumber=4512345678
Authorization: Bearer <token of the integration employee>

# 2. The caller chose "revoke and delete everything" for one record
POST https://api.telecomx.dk/pbx/recordingconsent/records/1234567890ABCDEF12345678/invalidate
Authorization: Bearer <token of the integration employee>
Content-Type: application/json

{ "deleteRecordings": true }