VoIP.infoThe independent guide to business communications.
VoIP.info Troubleshooting

FreePBX ARI user authenticates incorrectly or receives no events

Trace a FreePBX-managed ARI failure from module and generated user through HTTP or HTTPS, authentication, read-only authorization, event WebSocket, application registration and Stasis entry.

Reviewed 2026-10-23Current Sangoma module documentation, FreePBX arimanager release/17.0 source and Asterisk ARI, res_ari, HTTP and Stasis documentation reviewed October 23, 2026; public Sangoma interface examples may describe older PBX GUI versions and remain semantic rather than exact FreePBX 17 screen maps; installed FreePBX, framework, arimanager and Asterisk versions, saved database row, generated ari_general_additional.conf and ari_additional.conf, loaded modules, HTTP or HTTPS listener, prefix, certificate, origin policy, credential, application server, WebSocket, Stasis application, channel, request, event and response remain deployment specific; no PBX, module, database, configuration file, listener, certificate, credential, application, browser, socket, request, event, channel, media stream or call was inspected or testedAdvancedDocumentation based · not lab tested

Freeze one identity, endpoint, request and missing event

Record timestamp and timezone, FreePBX, framework, arimanager and Asterisk versions, module state, protected username, password format, read-only setting, Apply Config result, scheme, host, port, prefix, HTTP method and URI, response status, WebSocket close code, application name, channel identifier and first missing event. Redact the password, Authorization header and unnecessary calling data.

Classify the earliest divergence: record not saved; generated section absent or stale; ARI disabled or module missing; HTTP listener or route unavailable; TLS or prefix mismatch; authentication rejected; read-only authorization denies a mutation; origin policy blocks a browser; WebSocket fails; application is not registered; or the channel never enters Stasis.

Prove the managed user reached loaded configuration

Confirm the arimanager module is installed, enabled and signed as expected. Compare the saved record with the generated section in ari_additional.conf, including section name, password format and read_only, then confirm Apply Config completed. Check the generated general ARI settings separately.

A database row and a generated file are not runtime proof. Use ari show status and the installed module inventory to distinguish missing res_ari, disabled ARI and loaded behavior. Do not repair a generated file directly; correct the FreePBX owner and regenerate.

Trace HTTP or HTTPS before changing credentials

Use http show status to record running enabled state, bind address, port, prefix and ARI URI. From the application host, resolve the intended name, establish the intended TCP and TLS path and verify the served certificate before sending a credential. A local listener can be healthy while a firewall, proxy, name or prefix makes the remote path wrong.

If a browser reports a cross-origin failure, preserve its origin and the returned headers. Do not treat a permissive origin as authentication or make ARI broadly public to silence a browser error; use an application-server boundary.

Read authentication and authorization from the exact request

Send one bounded read request and retain method, path, status and sanitized body. A 401 points to the presented identity or secret path; a 404 can indicate an incorrect prefix, URI or unavailable resource; and a successful GET establishes only that operation. Compare the application credential with the current FreePBX-managed identity after any rotation.

If reads work but a state-changing request fails, inspect read_only before changing the password. Least privilege may be operating as intended. Do not widen rights until the application’s required methods and rollback path are documented.

Prove WebSocket, application registration and Stasis in order

After a REST read succeeds, establish the event WebSocket with the exact application name and preserve its handshake or close result. Confirm that the intended ARI application is registered. Then follow one controlled channel: dialplan reaches Stasis(app), the matching client receives StasisStart, expected events follow and StasisEnd closes the control interval.

An authenticated REST call does not register an event consumer. An open event WebSocket with the wrong application name does not own the intended Stasis call. A registered application still does not prove the route invoked Stasis or that media worked.

Correct one boundary and repeat the same transaction

Make one reversible change in the owning layer: FreePBX user or general setting, Apply Config, listener or certificate, protected network path, application credential, method permission, WebSocket application name or dialplan destination. Repeat the same request and Stasis entry before broadening the test.

After recovery, rotate temporary credentials, remove debug exposure and retain only sanitized status, timing and lifecycle evidence. No PBX, module, generated file, listener, credential, application, socket, request, event, channel, media stream or call was inspected or tested.

Sources & applicability

Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.

Examples require adaptation to your topology. No live PBX or hardware testing is claimed.

Continue your research

Guide · Current Sangoma module documentation, FreePBX arimanager release/17.0 source and Asterisk ARI, res_ari, HTTP and Stasis documentation reviewed October 23, 2026; public Sangoma interface examples may describe older PBX GUI versions and remain semantic rather than exact FreePBX 17 screen maps; installed FreePBX, framework, arimanager and Asterisk versions, saved database row, generated ari_general_additional.conf and ari_additional.conf, loaded modules, HTTP or HTTPS listener, prefix, certificate, origin policy, credential, application server, WebSocket, Stasis application, channel, request, event and response remain deployment specific; no PBX, module, database, configuration file, listener, certificate, credential, application, browser, socket, request, event, channel, media stream or call was inspected or tested

FreePBX ARI users: credentials, HTTP transport and Stasis evidence

Configure and verify a FreePBX-managed Asterisk REST Interface user without confusing a saved row, generated configuration, HTTP reachability, authentication, authorization, WebSocket events or Stasis control.

Read guide →
Guide · FreePBX 17 on Debian 12; Bulk Handler 17.0.7.1 release/17.0 metadata and Sangoma Bulk Handler workflow reviewed October 11, 2026; repository state does not prove the installed module or runtime, and no import or Apply Config operation was tested

FreePBX changes: submit, apply and verify

Keep GUI settings, generated configuration and runtime behavior aligned during routine administration.

Read guide →
Guide · Current Asterisk ARI configuration and getting-started guidance, latest Applications API, Certified Asterisk 22.8 Events API and Asterisk 22 REST data models reviewed October 10, 2026; no Asterisk host, ARI user, application, WebSocket, subscription, filter, event, resource, client handler or call tested

Asterisk ARI events and subscriptions: scope, filters and WebSocket ownership

Design ARI event delivery by separating application registration, automatic and explicit subscriptions, subscribe-all scope, event filters, connection ownership and client processing.

Read guide →
Guide · Current Asterisk 23 ARI channel, Stasis and bridge documentation reviewed October 9, 2026; no HTTP server, TLS profile, WebSocket, ARI user, application, host, endpoint, channel, bridge, media path or call was inspected or tested

Asterisk ARI channel origination: create, dial and prove application control

Choose direct originate or create-then-dial, retain client identifiers, and separate HTTP acceptance, Stasis ownership, answer, bridge membership, media and application outcome.

Read guide →
Troubleshooting · Current Asterisk ARI overview, configuration, getting-started, Stasis application, res_ari and outbound-WebSocket documentation reviewed October 6, 2026; exact running branch, build options, modules, configuration, credentials, application process, proxy, WebSocket, dialplan, channel and call require runtime verification

Asterisk ARI Stasis application is not registered: control-path diagnosis

Trace HTTP service, ARI user, WebSocket ownership, exact application name and Stasis lifecycle when a channel immediately leaves an ARI application.

Read guide →
Hub · Wireshark 4.x / current upstream tool documentation; inspect installed versions

VoIP diagnostics: collect evidence that answers a question

Move from a reported symptom to a bounded capture, a correlated call and an explainable result.

Explore topic →