VoIP.infoThe independent guide to business communications.
VoIP.info Guide

FreePBX ARI users: credentials, HTTP transport and Stasis evidence

Configure and verify a FreePBX-managed Asterisk REST Interface user without confusing a saved row, generated configuration, HTTP reachability, authentication, authorization, WebSocket events or Stasis control.

Reviewed 2026-10-23Current Sangoma module documentation, FreePBX arimanager release/17.0 source and Asterisk ARI, res_ari, HTTP and Stasis documentation reviewed October 23, 2026; public Sangoma interface examples may describe older PBX GUI versions and remain semantic rather than exact FreePBX 17 screen maps; installed FreePBX, framework, arimanager and Asterisk versions, saved database row, generated ari_general_additional.conf and ari_additional.conf, loaded modules, HTTP or HTTPS listener, prefix, certificate, origin policy, credential, application server, WebSocket, Stasis application, channel, request, event and response remain deployment specific; no PBX, module, database, configuration file, listener, certificate, credential, application, browser, socket, request, event, channel, media stream or call was inspected or testedAdvancedDocumentation based · not lab tested

Define the FreePBX and ARI ownership boundary

The FreePBX Asterisk REST Interface Users module manages ARI user records and generates Asterisk configuration; it is not the ARI application itself. Record the installed FreePBX framework, arimanager and Asterisk versions, module signature and enabled state before using a release/17.0 source description as an operating assumption.

Keep the administrative record, generated files, loaded res_ari behavior, HTTP listener, external application and live Stasis resources separate. Use FreePBX-managed fields as the durable edit point instead of editing generated files that Apply Config can replace.

Follow save, Apply Config and generated user state

A user edit creates or changes a FreePBX database row and marks configuration for reload. The current release/17.0 implementation emits general ARI settings to ari_general_additional.conf and users to ari_additional.conf, with type=user, password, password format and read_only. A successful form response is therefore not proof that the expected section was generated or loaded.

Preserve the protected username, selected password format, read-only choice, save result, Apply Config result, generated section name and loaded ARI status. Inspect generated output only as evidence; do not make it the long-lived source of truth.

Treat credentials and authorization as different checks

Asterisk ARI uses HTTP authentication for a configured user. FreePBX supports plain or crypt password formats and its current implementation attempts ari mkpasswd for crypt generation. Store the clear secret only in an approved secret system, keep it out of URLs, shell history and shared logs, and rotate the application together with FreePBX.

Authentication proves an identity was accepted. read_only=yes then limits that user to read-only requests; a successful GET does not prove a POST or DELETE is authorized. Use least privilege and preserve the exact HTTP method, URI, status and response body when diagnosing policy.

Qualify the HTTP listener, prefix, TLS and origin separately

ARI depends on Asterisk’s built-in HTTP server. Record enabled state, bind address, port, optional prefix, HTTP versus HTTPS endpoint and the certificate actually served. http show status identifies the running listener and enabled URIs; it does not prove that a remote network path, TLS name check or ARI credential works.

allowed_origins is a browser cross-origin policy, not a substitute for authentication, network restriction or an application server. Asterisk recommends placing ARI behind your own application server rather than exposing it directly to a web page. Restrict source paths and avoid broad public bindings unless the documented design requires them.

Separate REST requests, the event WebSocket and Stasis control

ARI historically uses HTTP for REST operations and a WebSocket for JSON events. Test the exact API path and credentials with a bounded read request, then test the event connection and requested application name separately. An HTTP 200 proves only that request; an open WebSocket proves only that connection.

A channel enters application control when dialplan invokes Stasis(app) and the matching application is registered. StasisStart, subsequent resource events and StasisEnd establish different lifecycle states. A user record, authenticated request or visible applications list does not prove that a call entered Stasis, stayed under control or produced media.

Build a reversible acceptance and rotation runbook

Before production, verify one least-privilege identity, generated configuration, loaded ARI and HTTP state, HTTPS certificate where used, one bounded read request, expected write denial or approval, event WebSocket, application registration, test Stasis entry and exit, reconnection and credential rotation. Preserve timestamps and request or channel identifiers without retaining secrets.

Apply one change at a time and define rollback for both FreePBX and the external application. The checks here are documentation-derived; no account, listener, socket, request, event, channel or call was exercised.

Sources & applicability

Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.

Examples require adaptation to your topology. No live PBX or hardware testing is claimed.

Continue your research

Troubleshooting · Current Sangoma module documentation, FreePBX arimanager release/17.0 source and Asterisk ARI, res_ari, HTTP and Stasis documentation reviewed October 23, 2026; public Sangoma interface examples may describe older PBX GUI versions and remain semantic rather than exact FreePBX 17 screen maps; installed FreePBX, framework, arimanager and Asterisk versions, saved database row, generated ari_general_additional.conf and ari_additional.conf, loaded modules, HTTP or HTTPS listener, prefix, certificate, origin policy, credential, application server, WebSocket, Stasis application, channel, request, event and response remain deployment specific; no PBX, module, database, configuration file, listener, certificate, credential, application, browser, socket, request, event, channel, media stream or call was inspected or tested

FreePBX ARI user authenticates incorrectly or receives no events

Trace a FreePBX-managed ARI failure from module and generated user through HTTP or HTTPS, authentication, read-only authorization, event WebSocket, application registration and Stasis entry.

Read guide →
Guide · FreePBX 17 / Debian 12; module UI varies

FreePBX module administration and updates

Inventory module state, preview dependencies and signatures, change the smallest intended set, and prove reload and call behavior before closing the window.

Read guide →
Guide · FreePBX 17 on Debian 12; Bulk Handler 17.0.7.1 release/17.0 metadata and Sangoma Bulk Handler workflow reviewed October 11, 2026; repository state does not prove the installed module or runtime, and no import or Apply Config operation was tested

FreePBX changes: submit, apply and verify

Keep GUI settings, generated configuration and runtime behavior aligned during routine administration.

Read guide →
Guide · Current Asterisk interface documentation reviewed September 30, 2026; implementation must be checked against the installed branch and integration library

Asterisk AMI, ARI and AGI: choose the control boundary

Separate management events, synchronous dialplan work and application-owned call control before exposing an integration.

Read guide →
Guide · Current Asterisk ARI configuration and getting-started guidance, latest Applications API, Certified Asterisk 22.8 Events API and Asterisk 22 REST data models reviewed October 10, 2026; no Asterisk host, ARI user, application, WebSocket, subscription, filter, event, resource, client handler or call tested

Asterisk ARI events and subscriptions: scope, filters and WebSocket ownership

Design ARI event delivery by separating application registration, automatic and explicit subscriptions, subscribe-all scope, event filters, connection ownership and client processing.

Read guide →
Troubleshooting · Current Asterisk ARI overview, configuration, getting-started, Stasis application, res_ari and outbound-WebSocket documentation reviewed October 6, 2026; exact running branch, build options, modules, configuration, credentials, application process, proxy, WebSocket, dialplan, channel and call require runtime verification

Asterisk ARI Stasis application is not registered: control-path diagnosis

Trace HTTP service, ARI user, WebSocket ownership, exact application name and Stasis lifecycle when a channel immediately leaves an ARI application.

Read guide →