Five9 package v1.0.0

Store the complete Cookie header value for a dedicated Five9 VCC agent or supervisor user in the client's secret manager. An external deployment process logs in, captures the issued session cookie, and refreshes the reference. The executor injects that value unchanged and does not log in.

The retrieved sample authenticates through a logged-in browser session. The full developer guide is gated, and HTTP Basic or token authentication for server-side callers has not been verified. Obtain the guide's session, expiry, and revocation terms before enabling.

Confirm session expiry and logout invalidation against the vendor guide before enabling; neither behavior was verified against first-party operation documentation in this review. The retrieved sources do not establish that changing a password or disabling a user invalidates an existing session. Refresh before expiry; an expired session fails closed. On suspected exposure, terminate the session itself rather than relying on account changes.

Use a dedicated user with only the agent or supervisor permissions these capabilities need: the session inherits the user's full permissions. Keep its value only in executor memory for a call, never in logs, traces, diagnostics, or crash dumps. Do not enable the pack if the deployment cannot meet those requirements.

Draft: the full Five9 Agent and Supervisor REST API developer guide was unavailable during review. On 2026-09-21, developer.five9.com remained unreachable and the vendor-hosted guide redirected to a login-gated portal; apidocs.five9.com was also unavailable in the review environment. Session, expiry, revocation, and call-disposition behavior across states remain unverified. Obtain those terms before enabling.

The registered paths come from the Five9 Developer Program's starter-kit repository, its agent_VCC_boilerplate.html sample, and the publicly hosted CRM SDK documentation. The repository's own README states that it is not an official or supported Five9 resource.

API coverage: this pack covers real-time call control and supervision through the session-based Agent and Supervisor REST API, with agent paths under /appsvcs/rs/svc and supervisor paths under /supsvcs/rs/svc. It does not cover the separate Configuration Web Services SOAP/WSDL API (users, campaigns, calling lists, skills, and dispositions, on api.<region>.five9.com or api.five9.com /wsadmin/...), which uses its own admin credentials, or the Statistics Web Services SOAP API. Domain administration needs a separate registration and review.

Host setup: a logged-in session calls https://app.five9.com/appsvcs/rs/svc/auth/metadata to obtain its data-center API host and port from metadata.dataCenters[].apiUrls[]. Replace the reserved five9-vcc.invalid host in every endpoint, resource locator, and egress allowlist entry together. The allowlist matches the authority exactly. If the returned port is not 443, review that port as well; the entries here specify the authority only.

Authentication: the retrieved sample uses browser session credentials (fetch credentials: 'include'). This pack stores a session cookie in the customer's vault and requires an external process to obtain and refresh it. No bearer scheme was verified; whether the gated guide supports HTTP Basic or API tokens for server-side callers remains an open review item.

Approval classification: calls.make_external places a live outbound call and declares create and send at R3; send requires human approval. calls.dispose records a disposition and finishes a call according to the sample, but termination behavior in every state is unverified. Where it ends an active customer call, that interruption cannot be reversed. Although update has an R2 floor, this capability declares delete and update at R3 to cover the possible termination.

Excluded operations: Configuration Web Services and Statistics Web Services; recording views and downloads (including POST /supsvcs/rs/svc/supervisors/{id}/agents/{id}/recording_views, which exposes recorded customer conversations); contact deletion and do-not-call (DNC) list changes; campaign start/stop and calling-list loading, which can drive mass outbound dialing; supervisor monitoring, whisper, and barge-in; and WebSocket event channels. Each requires its own registration and review.

Re-review on 2026-10-29: the legacy vendor PDF URL still redirected to the Five9 Documentation Center login portal. The guide bundle, its table of contents and a candidate vendor-hosted raw PDF were inaccessible through the web reader. The public Technical Requirements guide names the Agent and Supervisor REST API guide but supplies no registered operation contract. The Five9 GitHub organization lists admin and chat samples, not this REST reference. All seven operations and the session contract remain unverified against first-party operation documentation; keep this pack disabled.