Sign inGet Started
Get started
Guides
API Reference
SDKs
CLI
Knowledge Base
Changelog

Get a SIP trunk

GET
/v1/voice/trunks/{trunk_id}
const trunk = await bird.voice.trunks.get("trunk-id");
console.log(trunk.name, trunk.inbound_enabled, trunk.outbound_enabled);
Response200
{
  "id": "spt_01krdgeqcxet5s7t44vh8rt9mg",
  "workspace_id": "ws_01krdgeqcxet5s7t44vh8rt9mg",
  "name": "Production PBX trunk",
  "domain": "01kxp5bb9qf878642atrf0xy5r.trunk.eu1.sip.bird.com",
  "ip_acls": [
    {
      "id": "sta_01krdgeqcxet5s7t44vh8rt9mg",
      "trunk_id": "spt_01krdgeqcxet5s7t44vh8rt9mg",
      "cidr": "203.0.113.0/24",
      "description": "Office network"
    }
  ],
  "allowed_api_key_ids": [
    "key_01krdgeqcxet5s7t44vh8rt9mg"
  ],
  "ineligible_api_key_ids": [
    "key_01krdgeqcxet5s7t44vh8rt9mg"
  ],
  "digest_algorithms": [
    "SHA-256",
    "MD5"
  ],
  "media": {
    "encryption": "preferred"
  },
  "created_at": "2026-05-20T09:14:52Z",
  "updated_at": "2026-05-25T16:42:01Z"
}

Returns a single SIP trunk, including its Bird-assigned domain, its IP access control lists, and its allowed API keys. Returns a 404 not_found_error if the trunk does not exist in the workspace.

Parameters

trunk_idstring

ID of the SIP trunk to retrieve, update, or delete.

Response Payload

id
string
required

Unique identifier for this SIP trunk.

workspace_id
string
required
name
string
required

A human-readable label for this SIP trunk. Mutable, and distinct from the generated wire domain.

domain
string
required

Full SIP address for this trunk, generated as {trunk-id}.trunk.{region}.sip.bird.com. This is the trunk's identity, so configure your PBX or SIP client to send calls to this address. It is derived from the trunk id and cannot be chosen or changed.

outbound_enabled
boolean
required

Whether this trunk may place calls: your PBX connects to us to dial out. Off on a new trunk. While it is off the trunk refuses every call attempt no matter what its allow lists say, and the connection and authentication settings below have no effect. Set outbound_enabled through the trunk update operation.

inbound_enabled
boolean
required

Whether this trunk may receive calls: we dial the addresses you declared, for the numbers this trunk answers. Off on a new trunk. Turning it off resets number routes that use this trunk to reject incoming calls. Turning it back on does not restore those routes. Set inbound_enabled through the trunk update operation.

media_bypass
boolean
required

Whether we take ourselves out of the audio path for calls we forward to this trunk: your equipment and the originating carrier exchange audio directly, and only the call signalling passes through us. Off by default. It applies to inbound calls alone (calls this trunk places are always carried through us, whatever this says). While it is on we cannot record those calls, report their audio quality, or end one because its audio stopped. Your equipment must be reachable for audio from the public internet. Set media_bypass through the trunk update operation.

ip_acls
array of object
required

The trunk's IP allow list. IP filtering is active whenever this has at least one entry: calls admitted through the allow lists must come from those CIDR ranges. This restriction does not apply to session credentials when session_credentials_enabled is true. An empty list means no IP restriction. Replace the whole ip_acls list through the trunk update operation.

Show child attributes
allowed_api_key_ids
array of string
required

The API keys allowed to authenticate this trunk over SIP Digest. A key must hold voice at write level and be neither revoked nor expired to authenticate. ineligible_api_key_ids names the entries that currently cannot. A nonempty list enables API-key authentication, limited to its eligible keys. An empty list means no API-key authentication. A trunk with empty ip_acls and allowed_api_key_ids lists accepts nothing when session_credentials_enabled is false. Replace the whole allowed_api_key_ids list through the trunk update operation.

ineligible_api_key_ids
array of string
required

The entries in allowed_api_key_ids that cannot authenticate this trunk right now because the key lacks voice at write level, has expired, or was revoked. The bindings remain until you remove them from the trunk. Restoring voice at write level makes a key eligible again if it is still unexpired and unrevoked, without changing its secret or trunk binding. Empty when every allowed key can authenticate.

digest_algorithms
array of string
required

The Digest hash algorithms this trunk offers, in the order they are offered. We send one challenge line per algorithm and your PBX answers with the first it supports, so the order decides what most equipment picks. Always populated: a trunk with no explicit setting reports the default, ["SHA-256", "MD5"]. A trunk answering with an algorithm that is not on this list is rejected, so narrowing the list also narrows what the trunk accepts. Replace digest_algorithms through the trunk update operation.

session_credentials_enabled
boolean
required

Whether a session credential may be used to connect to this trunk from a web browser, the CLI or MCP, alongside whatever the allow lists admit. Off by default. It grants nothing on its own: a call still has to present a credential issued to this workspace, and each one expires within minutes. Set session_credentials_enabled through the trunk update operation.

media
object
required

How the trunk carries call audio. Set it through the trunk update operation.

Show child attributes
media.encryption
string
required

Controls SRTP encryption between your equipment and Bird. SRTP keys use SDES (a=crypto) over TLS signalling. Audio between Bird and the carrier uses plain RTP.

With preferred, a call you place is encrypted when your equipment offers RTP/SAVP or RTP/SAVPF with an AES_CM_128_HMAC_SHA1_80 or _32 key over TLS. A plain RTP offer stays plain. Calls delivered to a TLS gateway (sips: or ;transport=tls) use encryption when available. Calls delivered through a gateway without TLS or with media_bypass use plain audio.

With required, a plain call is refused with 488 Not Acceptable Here. Delivered calls require encrypted media, so your gateways must use TLS. You cannot combine required with media_bypass because bypassed audio does not pass through the relay that encrypts it.

With preferred or required, an SDES offer over plain SIP (UDP or TCP), an offer without a usable key, and DTLS-SRTP are refused with 488 and a Warning header naming the reason.

With off, Bird does not encrypt audio and relays an SRTP offer unchanged. Browser calls use DTLS-SRTP regardless of this setting.

Possible values: off, preferred, required

created_at
string
required
updated_at
string
required

Related resources

Continue with the documentation, guides and examples for this topic.

Get an implementation brief