The Orion Call Entry API lets authorized call-center applications search, retrieve, create, and replace customer-service call records. It also provides the caller, call, transaction, and product classifications needed when working with those records.

Every request requires an OAuth bearer token validated by Kong and, when configured, independently by Orion. Orion requires a partyId and verifies that the caller has the appropriate fine-grained access: read access for searches, individual records, and lookup values; write access for creating or replacing records.

Consumers identify the company whose data they are accessing with the X-Client-Code header. The clientCode query parameter remains available only on the two existing GET operations for backward compatibility.

For writes, Orion determines the acting user from the first available valid identity claim in this order: https://api.zinnia.io/email, https://qa.api.zinnia.io/email, https://dev.api.zinnia.io/email, upn, then email. When one of these claims is present, the request body’s userName is ignored. If none of these claims is present, Orion uses the trimmed userName from the request body to identify the caller in machine-to-machine scenarios.

Lookup values are trimmed and matched without regard to letter casing. Orion resolves them to the company’s active canonical values. These names are stable API identifiers, so renaming one is a breaking compatibility change. Duplicate active names indicate invalid company configuration.

Create and replace requests are idempotent for at least 24 hours. Orion compares the company, operation and record identity, actor, submitted fields, resolved lookup values, contracts, and call types; contract and call-type ordering does not affect the comparison. A completed replay returns the original result with X-Idempotent-Replay. Reusing an idempotency key for a different request, or while the original request is still in progress, returns 409 Conflict.