Asterisk AMI, ARI and AGI

Choose by responsibility

AMI exposes management actions and events. AGI lets an external program participate in dialplan execution. ARI exposes channels, bridges and media primitives for applications that control their own communications behavior, with asynchronous events delivered over WebSocket.

A reporting integration and a custom call application have different needs. Do not choose an interface solely because it can technically originate a call; choose according to who should own the call’s state and failure handling.

Design the event lifecycle

Record how the integration identifies a call, reconnects after a connection loss and handles duplicated or late events. A successful API response does not necessarily mean the far end answered. Correlate later channel events and the appropriate call identifiers.

For an ARI application, define what happens if the controlling process disappears while channels are active. For AGI, bound external requests so a slow dependency does not leave callers waiting indefinitely.

Limit privileges and network access

Keep management interfaces on a restricted network and grant only the operations the integration requires. Use separate credentials per application, encrypted transports where supported and a revocation path. Never publish sample credentials or expose a general management listener to every phone network.

Test a denied action as well as a permitted one. Filtering events for privacy and reducing privileges are separate controls; neither substitutes for the other.

Observe before expanding

Start with a read-only event consumer and a test call. Verify call correlation through hold, transfer and hangup, then add only the necessary control actions. Retain an operational way to stop the integration without losing the ordinary PBX dialplan.