Capture criteria
Each capture must include at least one search criterion. Operators can start with a caller number, called DID, tenant code, SIP domain, provider IP, free-text marker, or a known Call-ID after the call already exists.
Agents receive scoped capture commands, stream matching events back to a command center, and preserve session history for later review.
Each capture must include at least one search criterion. Operators can start with a caller number, called DID, tenant code, SIP domain, provider IP, free-text marker, or a known Call-ID after the call already exists.
Agents can run near Kamailio, FreeSWITCH, Asterisk, RTP engines, and log files. Tags let command centers target edge, access, PBX, media, and location-specific groups.
Hosted and standalone command centers expose the same capture workflow: choose agents, define safe criteria, start a bounded session, then stream or review the resulting SIP, RTP, and log evidence.
/api/sessionsCreate a capture session. At least one search criterion is required: caller, called number, tenant code, SIP domain, provider IP, free text, or known Call-ID. SIP method can narrow the capture, but it is not enough by itself.
/api/sessionsList recent sessions, including status, expiration, event count, agent count, and sharing state.
/api/sessions/{id}Fetch one session's metadata for dashboard views, ticket handoff, or automation.
/api/sessions/{id}/eventsRead captured events after a given event id. Events include SIP packets, WebRTC packet markers, RTP packet samples, and correlated logs.
/api/sessions/{id}/streamSubscribe to a live server-sent event stream while a capture is running.
/api/sessions/{id}Stop a running capture. Add ?purge=1 to delete a stopped session and its stored events.
These examples use documentation-only numbers. In production, capture by caller, called DID, tenant code, SIP domain, provider IP, or known Call-ID.
POST /api/sessions
Content-Type: application/json
{
"label": "customer DID test",
"duration_seconds": 3600,
"criteria": {
"from": "15554430191",
"to": "15558672044",
"method": "INVITE"
},
"capture_rtp": false,
"capture_pcap": true,
"agent_ids": [12, 18, 29]
}
POST /api/sessions
Content-Type: application/json
{
"label": "registration trace",
"duration_seconds": 900,
"criteria": {
"text": "customer-domain.example",
"method": "REGISTER"
},
"capture_rtp": false,
"capture_pcap": false,
"agent_ids": [7, 8]
}
POST /api/sessions
Content-Type: application/json
{
"label": "known call follow-up",
"duration_seconds": 1800,
"criteria": {
"call_id": "c38b4c9d7b0e@example-sbc",
"method": "INVITE"
},
"capture_rtp": true,
"capture_pcap": true,
"agent_ids": [2, 9, 14, 23]
}
HTTP/1.1 201 Created
Content-Type: application/json
{
"id": "d8e3a6b8f0c24c7a93fb",
"status": "running",
"expires_at": "2026-06-20T21:30:00Z",
"agents": 4,
"stream": "/api/sessions/d8e3a6b8f0c24c7a93fb/stream"
}
TunaIO is designed for support escalation as much as live troubleshooting, so every useful capture needs a clean handoff path.
/api/sessions/{id}/shareCreate a public read-only share link for a selected session. Share links can be revoked at any time.
/api/sessions/{id}/shareRevoke public access to a shared capture.
PNG exportExport the currently rendered ladder view from the command center or shared-session view as an image for tickets, outage reports, and customer-facing summaries.
/api/sessions/{id}/export.tarDownload retained per-agent PCAP files as a tar bundle when raw packet export is enabled for the session.
/api/share/{token}/export.tarDownload the same packet bundle from a public shared capture when packet export exists.
/api/agentsList agents and tags, such as edge, access, PBX SBC, Asterisk, FreeSWITCH, location, and provider groups.
/api/agentsAdd or update an agent by name, URL, token, enabled flag, and comma-separated tags.
/api/ingestAgent-only endpoint for captured events. It is protected separately from the operator UI and accepts collector bearer tokens.
Hosted and standalone command centers support authenticated UI access, authenticated agent commands, and authenticated agent ingest.
Sessions are bounded by expiration policy, with configurable event history and packet export retention.
Agent collectors can be extended for additional log sources, route metadata, WebRTC signaling, and platform-specific call state.