Skip to main content

Automatic Call Recording Export via Email and S3

4phone can automatically send completed call recordings to Email and to a customer's S3-compatible storage. Both channels operate independently: you can enable Email only, S3 only, or both at the same time.

Important

Deliveries are created only for new inbound, outbound, and internal calls whose recording has been successfully generated and marked as available. Older recordings are not exported retroactively.

Who can change these settings​

This section is available to users with the Owner, Administrator, or Superadmin role.

Before configuring exports, verify that:

  1. call recording is enabled for the relevant extensions and routing scenarios;
  2. Email recipients have access to their business mailboxes;
  3. a dedicated S3 access key has been created with permissions restricted to the target bucket;
  4. the external S3 endpoint is reachable over a public HTTPS address.

Where to find the settings​

  1. Log in to the 4phone dashboard.
  2. Open Settings.
  3. Go to the Webhooks/API tab.
  4. Open Recording Export.

At the top of the page, counters display successful Email and S3 deliveries, recordings currently in processing, and failed deliveries.

Setting up Email delivery​

For a safe rollout, configure and test the channel first, then enable automatic delivery:

  1. Leave the Enable email toggle turned off.
  2. In the Recipients field, enter up to 20 email addresses, one per line.
  3. Specify the secure link expiration period from 1 to 720 hours. The default value is 168 hours (7 days).
  4. Click Save settings.
  5. Click Send test email.
  6. Confirm that the test email arrives and the status OK appears next to the test button.
  7. Turn on Enable email.
  8. Click Save settings again.

Each recording is sent individually to every configured recipient.

If the recording size does not exceed 20 MB, the audio file is attached directly to the email. For larger recordings, the email contains a secure link to download the MP3 file.

The email also includes:

  1. call direction;
  2. caller and callee numbers;
  3. date and time;
  4. duration;
  5. call status.
Check

Once the configured expiration period passes, the download link stops working. Do not forward the email or link to individuals who are not authorized to access call recordings.

Setting up S3 export​

AWS S3, MinIO, and other S3-compatible object storage services are supported.

What details to prepare​

You will need:

  1. Endpoint (if using a provider other than AWS S3);
  2. Region;
  3. Bucket name;
  4. Access Key ID;
  5. Secret Access Key;
  6. Session Token (only if your provider issued temporary credentials);
  7. an optional object prefix, such as 4phone/recordings.

The access key must allow bucket verification and object uploads. For AWS S3, this typically requires s3:ListBucket on the bucket and s3:PutObject on the selected prefix.

Endpoint requirements​

For AWS S3, leave the Endpoint field empty. For other providers, enter a URL in the format:

https://s3.example.com

The endpoint must:

  1. use HTTPS;
  2. have a public DNS name and a public IP address;
  3. not contain a username, password, path, or query parameters;
  4. not point to localhost or a private/internal network.

Configuration steps​

  1. Leave the Enable S3 toggle turned off.
  2. Fill in Endpoint, Region, Bucket, and Object prefix.
  3. Enter Access Key ID and Secret Access Key.
  4. Enter Session Token if required.
  5. Enable Use path-style addressing if required by your S3 provider. This is typically needed for MinIO and certain S3-compatible storage systems. AWS S3 generally uses virtual-hosted–style addressing (path-style disabled).
  6. Click Save settings.
  7. Click Test S3 connection.
  8. Confirm that the status OK appears next to the test button.
  9. Turn on Enable S3.
  10. Click Save settings again.

The secret key is stored encrypted and is never returned to the browser. The next time you open the page, the credential fields will appear empty. This is expected: your saved key remains active.

Check

If you entered new credentials, save them first. While the new key fields contain unsaved input, the S3 connection test button is disabled.

How the S3 object key is structured​

Recordings are organized by call date:

prefix/YYYY/MM/DD/callId.wav

For example:

4phone/recordings/2026/07/21/7db6f2ab-2e56-4cb4-b544-42a72f8f47be.wav

The file extension matches the original recording file. Service metadata is attached to the object: call ID, direction, caller/callee numbers, and SHA-256 checksum.

How to verify delivery after enabling​

  1. Place a short test call.
  2. End the call and wait for the recording to be finalized.
  3. Open the Recording delivery history section.
  4. Click Refresh.
  5. Check the individual delivery row for each active channel and Email recipient.
  6. For Email, verify the attachment or secure download link.
  7. For S3, verify that the object appears in the folder for the corresponding date.

A recording may not appear in the history immediately: delivery starts only after the call is fully processed and the audio file is ready.

Delivery statuses​

  1. PENDING: delivery is queued for processing.
  2. PROCESSING: the file is currently being sent.
  3. DELIVERED: delivery completed successfully.
  4. FAILED: the attempt failed; the system will retry automatically.
  5. DLQ: automatic retries have been exhausted, or the delivery was canceled after a settings change.

The system performs up to 8 automatic attempts with exponential backoff.

Manual replay​

After fixing a configuration issue, click Replay on the relevant row in the delivery history. The attempt counter will reset and the delivery will be queued again.

Check

The Replay button is also available for already delivered recordings. Triggering it will resend the Email or re-upload the S3 object to the same key.

Common issues​

Test Email button is disabled​

Enter at least one recipient and click Save settings first. The test email is sent to the first address in the saved list.

Test S3 button is disabled​

Verify that the bucket and credentials have been saved. If the credential fields contain newly typed values, save the settings and wait for the fields to clear.

S3 returns AccessDenied​

Check the following:

  1. Region and bucket name are accurate;
  2. permission to list/check the bucket;
  3. permission to upload objects under the configured prefix;
  4. bucket policy restrictions by IP address or network.

If the connection test succeeds but actual uploads fail, your key may have bucket-check permissions without object-upload permissions.

Endpoint is rejected when saving​

Use a public HTTPS URL without a path or query string. Private IP addresses and local hostnames are intentionally blocked.

No delivery after a call​

Check the following:

  1. whether the desired channel is enabled;
  2. whether the settings were saved;
  3. whether call recording was enabled for the call;
  4. whether the recording appears in call history;
  5. whether the call ended before the export feature was enabled.

This feature does not retroactively create deliveries for previously recorded conversations.

Pre-launch verification
  1. Email or S3 connection test succeeded;
  2. the desired channel is enabled and settings are saved;
  3. inbound, outbound, and internal calls have been tested;
  4. the recipient can open and play the recording;
  5. the S3 object is created under the expected prefix;
  6. access to the mailbox and S3 bucket is restricted to authorized staff.

For more details, see Call Recordings and Quality Control and Common Issues and Quick Fixes.