1. Extension Management

AiPBX extensions are powered by Asterisk 22 PJSIP. Users can place and receive calls using their single extension number across physical desk phones, web browsers, and native mobile apps:

Extension Type	Protocol & Transport	Target Devices
Hardware SIP Phone	SIP / PJSIP (UDP, TCP, TLS)	Yealink, Fanvil, Grandstream, Cisco, Snom, Gigaset DECT.
WebRTC Webphone	WSS (Port 443 ALPN) + DTLS-SRTP	Zero-plugin browser calling in Chrome, Edge, Firefox, Safari.
Mobile Client	WSS / TURNS + FCM / APNs Push	AiPBX Android (Kotlin) & iOS (Swift) native apps.
Digital Fax	T.38 / Spooler	Digital fax extension routing inbound faxes as PDF to email.

2. Multi-Level Interactive Voice Response (IVR)

Unlimited Sub-Menus: Multi-tiered routing tree for departments, languages, and locations.
Digit Timeout Parameter: Configurable wait duration (1–15 seconds) for customer DTMF input.
Direct Extension Dialing: Callers who know their party's extension can dial it at any time during the prompt.
Timeout & Invalid Fallbacks: Safe routing to operators or voicemails on invalid input or timeout.
Business Hours & Holidays: Automated switching between working hours, lunch breaks, and holidays.

3. Inbound (DID) & Outbound Call Routing

Routing Tier	Capabilities & Logic
Inbound DID Routes	Regex pattern matching for external telecom provider DIDs; routes to IVRs, queues, or ring groups.
Outbound Routes	Department-level outbound dial rules (Local, Mobile, International permissions).
Trunk Failover	Automatic failover to secondary and tertiary SIP trunks if primary trunk is unavailable.

4. WebRTC In-Browser Softphone

A native WebRTC softphone is integrated directly into the web management portal:

Opus HD Audio: Crystal-clear voice quality adapting dynamically to network conditions.
DTMF Keypad: Instant in-call touch-tone dialing.
Call Controls: Hold, Mute, Blind Transfer, and Attended (Warm) Transfer.
Audio Device Selector: Select headset, microphone, and speakers dynamically.

5. Digital Fax Server (FoIP / T.38)

Inbound Fax (Fax-to-Email): Incoming T.38 faxes are digitized into PDF documents and delivered via email.
Outbound Fax (Web-to-Fax): Upload PDF documents via web dashboard; Asterisk spools and transmits with delivery receipts.

6. Feature Codes (Star Codes Directory)

Code	Feature Name	Allowed Roles	Description
*78	DND Enable	All / Tümü	Enables Do Not Disturb.
*79	DND Disable	All / Tümü	Disables Do Not Disturb.
*72<number>	Call Forward	All / Tümü	Forwards calls to the dialed number.
*73	Cancel Forward	All / Tümü	Cancels active call forwarding.
*8	Group Pickup	All / Tümü	Picks up a ringing call within your pickup group.
*21<ext>	Directed Pickup	All / Tümü	Picks up a ringing call on a specific extension.
*90	Call Spy	admin, cc_manager	Enters ChanSpy audio monitoring mode.
*81<qid>	Queue Login	admin, cc_manager, cc_agent	Logs dynamic agent into queue.
*80<qid>	Queue Logout	admin, cc_manager, cc_agent	Logs dynamic agent out of queue.
*22<reason>	Queue Pause	admin, cc_manager, cc_agent, user	Pauses agent across all queues (Double beep).
*23	Queue Unpause	admin, cc_manager, cc_agent, user	Unpauses agent, ready for calls (Single beep).

7. Biometric Passkey (WebAuthn / FIDO2) & 2FA

AiPBX v1.0.34 introduces phishing-resistant, passwordless authentication governed by the FIDO2 / WebAuthn W3C standard. Credential stuffing and brute-force attacks are rendered cryptographically impossible:

Platform Authenticators: Apple Touch ID / Face ID, Windows Hello biometric sensor, Android Fingerprint/Face unlock.
Roaming Security Keys: YubiKey, Google Titan, and standard FIDO2 USB/NFC hardware tokens.
TOTP Two-Factor Backup: Time-based one-time password fallback via Google Authenticator, Microsoft Authenticator, or Bitwarden.

8. Google OAuth 2.0 Enterprise Single Sign-On

Organizations utilizing Google Workspace can authenticate seamlessly. Whenever an extension's assigned email address matches an active corporate Google account, users log into the Web Portal and mobile apps with a single click.

9. Go WebSocket Real-Time Chat Engine (aipbx-chat)

Engineered in Go, the standalone aipbx-chat daemon runs on TCP Port 8090 delivering high-concurrency instant messaging:

Goroutine Scalability: Multiplexes tens of thousands of active WebSockets with lightweight memory consumption.
Direct & Group Channels: 1-on-1 private messaging and department group channels up to 256 users.
Attachments & Voice Notes: Automated client-side media compression and document transfers.
FCM / APNs Delivery: Instant push wakeup when recipient apps are backgrounded or killed.

10. Granular Outbound Call Barring & Feature Matrix

AiPBX enforces 6-tier outbound dialing policies to protect telecom budgets. Explore the interactive JSON table system for side-by-side matrices, network port breakdowns, and hardware sizing:

Open Full Interactive JSON Table System & Matrix →

11. Port 443 Nginx L4 Stream & ALPN Multiplexing

Strict enterprise firewalls and public guest networks routinely block VoIP ports (SIP 5060/5061) while permitting outbound TCP 443. AiPBX employs Nginx layer-4 stream with ssl_preread to inspect the TLS ClientHello ALPN token without terminating TLS. A single TCP port 443 handles HTTPS web traffic (:8443), Asterisk WebRTC WSS signaling (:8089), and encrypted SIP TLS (:5061) seamlessly.

/etc/nginx/nginx.conf — Nginx L4 ALPN Stream Configuration

stream {
    map $ssl_preread_alpn_protocols $upstream_backend {
        "http/1.1"        127.0.0.1:8443;   # Apache Web Portal
        "h2"              127.0.0.1:8443;   # HTTP/2 Web Portal
        "webrtc"          127.0.0.1:8089;   # Asterisk WebRTC WSS
        "sip"             127.0.0.1:5061;   # PJSIP TLS SIP Core
        default           127.0.0.1:8443;   # Standard HTTPS Fallback
    }

    server {
        listen 443;
        listen [::]:443;
        proxy_pass $upstream_backend;
        ssl_preread on;
    }
}

Zero Port Sprawl: Exposes only TCP port 443, drastically shrinking public attack surface.
Line-Rate Throughput: Pass-through routing without decryption retains end-to-end TLS integrity with zero CPU tax.

12. Integrated In-Dialer Chat & Mobile Softphone (v1.0.35)

AiPBX native Android (Kotlin) and iOS (Swift) clients v1.0.35 feature an in-dialer collaborative chatroom. While on an active voice call, agents and team members can exchange instant messages, clipboard data, customer account IDs, and photos without leaving the dialer or placing the call on hold. Powered by an isolated Go WebSocket daemon with sub-millisecond dispatch.

Go WebSocket In-Dialer Chat Protocol Payload

{
  "type": "dialer_chat",
  "call_id": "c7f918bc-21a4-4e78-9e12-38d58c89b210",
  "sender_ext": "1002",
  "receiver_ext": "1005",
  "timestamp": 1727173200,
  "payload": {
    "message": "Müşterinin fatura numarası: #TR-99412. Siparişi onaylıyorum.",
    "attachments": []
  }
}

13. Visual CDR LinkedID Call Journey Timeline

Legacy PBXs fragment CDR records whenever a call is transferred, parked, or queued. AiPBX groups all call segments under Asterisk's unique LinkedID, rendering an end-to-end interactive timeline: ingress trunk, IVR navigation, queue wait duration, agent answer, consultative transfer, and hangup cause.

MariaDB SQL — LinkedID Call Journey Aggregation Query

SELECT 
    c.uniqueid, c.linkedid, c.calldate, c.src, c.dst, 
    c.duration, c.billsec, c.disposition, c.lastapp, c.lastdata
FROM cdr c
WHERE c.linkedid = '1727171420.482'
ORDER BY c.calldate ASC;

14. Boss-Secretary Screening & VIP Whitelist

Executive call screening intercepts all inbound calls to C-level extensions, diverting them to an authorized executive assistant. Assistants screen and bridge callers using attended transfer (*21). VIP whitelist entries (Board members, strategic clients) automatically bypass the assistant filter and ring the executive's deskphone and mobile app directly.

/etc/asterisk/extensions_boss_secretary.conf

[sub-boss-screening]
exten => _100[1-5],1,NoOp(Boss Secretary Screening for ${EXTEN})
 same => n,Set(IS_VIP=${DB(vip_whitelist/${CALLERID(num)})})
 same => n,GotoIf($["${IS_VIP}" = "1"]?direct_boss)
 same => n,Dial(PJSIP/2000,25,tT) ; Ring Executive Assistant
 same => n,Hangup()
 same => n(direct_boss),Dial(PJSIP/${EXTEN},30,tTkK)
 same => n,Hangup()

15. Dynamic Voice Conferences & Web Moderator (*8000)

High-capacity voice conferencing powered by Asterisk app_confbridge supporting 100+ participants per bridge with DSP hardware acceleration. Extensions and external callers dial *8000, enter a secure PIN, and join immediately. The real-time Web Moderator console displays active speaker meters, one-click global mute, and individual kick controls.

16. Advanced Voicemail-to-Email MP3 & Web Player (*97)

When an extension is unanswered, busy, or unreachable, callers are guided to an interactive mailbox. Audio recordings are immediately encoded into compact MP3s and dispatched via SMTP with caller ID, timestamp, and duration. Extensions can inspect and play voicemails directly via *97 IVR or the in-browser audio player.

17. Supervisor Call Spy, Whisper & Barge-in (*90)

Enterprise call center quality assurance with 3 dynamic modes accessible via Asterisk ChanSpy:
1. Silent Monitoring: Dial *90<ext> to listen undetected without beeps or artifacts.
2. Whisper Coaching: Press 5 to talk directly into the agent's earpiece; the caller hears nothing.
3. 3-Way Barge-in: Press 6 to convert the active call into a 3-party conference for direct escalation handling.

/etc/asterisk/extensions_chanspy.conf

; *90<ext> — Supervisor Live Monitor & Coaching
exten => _*90XXXX,1,NoOp(ChanSpy initiated by ${CALLERID(num)} on ${EXTEN:3})
 same => n,Authenticate(9512) ; Supervisor PIN
 same => n,ChanSpy(PJSIP/${EXTEN:3},qwB)
 same => n,Hangup()

18. Enterprise Ring Groups (Ring-All, Round-Robin, Hunt)

4 intelligent call distribution strategies engineered for departmental inbound routing:
• Ring-All: Rings all group members simultaneously; first pickup claims the call.
• Round-Robin: Cyclically balances incoming call volume evenly across available agents.
• Linear Hunt: Traverses extensions sequentially in configured priority order.
• Memory Hunt: Rings tier 1, and if unanswered, continues ringing tier 1 while escalating to tier 2.

19. Trunk-to-Trunk Transit Routing & DID Normalization

Carrier-grade transit switching interconnecting disparate SIP trunks, branch office gateways, and external legacy PBXs. Powerful regular expressions strip or prepend regional dial prefixes (e.g. leading zeros, country codes) enforcing strict E.164 compliance before handing calls off to downstream transit trunks.

20. Microsoft Teams Direct Routing TLS/SRTP SBC Gateway

AiPBX provides a native, hardware-free Microsoft 365 Teams Direct Routing SBC interface. Asterisk 22 PJSIP natively terminates Microsoft Teams SIP signaling over TLS 5061 with trusted CA chains and encrypts media using SRTP AES_CM_128. Enables Teams desktop and mobile users to place and receive corporate PBX calls effortlessly.

PowerShell — Microsoft Teams PSTN Gateway Provisioning

# 1. Register AiPBX SBC Gateway in Microsoft 365 Tenant
New-CsOnlinePSTNGateway -Fqdn "sbc.aipbx.bid" -SipSignalingPort 5061 `
    -MaxConcurrentSessions 100 -Enabled $true

# 2. Assign Voice Routing Policy to Teams User
Set-CsPhoneNumberAssignment -Identity "user@company.com" -PhoneNumber "+902129990001" -PhoneNumberType DirectRouting
Grant-CsOnlineVoiceRoutingPolicy -Identity "user@company.com" -PolicyName "AiPBX-PSTN-Policy"

Enterprise PBX Features & Core Modules