five9 v1.0.0

The pack names a reference, never a secret. Installing a pack registers capabilities and makes them governable; registration is not connectivity. The credential is created at the provider and held in the client's own secret manager under the reference the pack names, and deployment testing is still required to show the credential path works and cannot be bypassed.

Reference

secret-ref-five9-vcc-session-cookie

Custody

customer_vault

Injection

header (Cookie)

A Five9 VCC session cookie for a dedicated agent-or-supervisor user, held in the client's own secret manager. The retrieved Five9 developer-program starter kit authenticates REST calls with the logged-in browser session (fetch with credentials: 'include'), and no token-based scheme for this API was verified at review time — the full Agent and Supervisor REST API developer guide is gated, so whether HTTP Basic with VCC credentials or an API token is supported for server-side callers is an open review item before enabling. TOKEN ISSUANCE IS EXTERNAL: an external deployment process performs the VCC login for the dedicated user, captures the session cookie, and stores it; the stored material must be the complete Cookie header value exactly as the session issued it. The executor injects the stored value verbatim and performs no login itself. Expiry and revocation: the retrieved material establishes only that VCC sessions expire and that logout ends a session. Whether a password change or user disablement invalidates an already-issued live session is NOT established by any source retrieved at review time — the full developer guide is gated and Five9's developer documentation sites were unreachable — so this pack makes no such guarantee: the custody job must refresh the reference before expiry, an expired session fails closed, and on suspected exposure the deployment must terminate the session itself rather than rely on account-side changes. Obtaining the gated Agent and Supervisor REST API developer guide's session, expiry and revocation terms is an open review item before enabling. Least privilege: the session acts with the full permissions of the logged-in VCC user, so use a dedicated service user with only the agent or supervisor permissions these capabilities need, and nothing more. Executor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack.

• five9-vcc-agents (api, pii): https://five9-vcc.invalid/appsvcs/rs/svc/agents
• five9-vcc-contacts (api, pii): https://five9-vcc.invalid/appsvcs/rs/svc/orgs/ORG_ID/contacts
• five9-vcc-supervisor (api, internal): https://five9-vcc.invalid/supsvcs/rs/svc

DRAFT — verification limits a reviewer must weigh. Five9's Agent and Supervisor REST API developer guide is gated behind the Five9 Developer Program and could not be fetched at review time, and Five9's developer documentation sites (developer.five9.com, apidocs.five9.com) were unreachable from the review environment. This pack was scaffolded from what was actually retrieved: Five9's official developer-program starter-kit repository (whose own README disclaims being an officially supported Five9 resource), its sample agent_VCC_boilerplate.html, and Five9's publicly hosted CRM SDK documentation. At the 2026-09-21 re-review, developer.five9.com remained unreachable and the vendor-hosted VCC Agent and Supervisor REST API reference guide PDF redirected to a login-gated documentation portal, so the guide's session, expiry, revocation and per-state dispose semantics remain unverified; the starter-kit README's disclaimer that the repository is not an official or supported Five9 resource was retrieved and stands. Every endpoint path registered here is one the boilerplate exercises. THE ADMIN vs SUPERVISOR SPLIT, STATED HONESTLY: Five9 exposes at least three distinct API surfaces. (1) The administrative surface — users, campaigns, calling lists, skills, dispositions — is the Configuration Web Services API, a SOAP/WSDL service on a separate host pattern (api.<region>.five9.com / api.five9.com /wsadmin/...) with its own admin credentials; this pack registers NOTHING on it. (2) The statistics surface is a second SOAP service (Statistics Web Services); this pack registers nothing on it either. (3) The Agent and Supervisor REST API — session-scoped, for real-time call control and supervision — is what this pack covers: agent-context paths under /appsvcs/rs/svc and supervisor-context paths under /supsvcs/rs/svc. Do not read any capability here as governing Five9 administration; domain administration is a different registration requiring its own review. HOST SUBSTITUTION: the REST API host and port are not fixed — the session metadata endpoint (https://app.five9.com/appsvcs/rs/svc/auth/metadata, called with the logged-in session) returns the data center's API host and port (metadata.dataCenters[].apiUrls[]), and the client builds https://<host>:<port> from them. The endpoint host 'five9-vcc.invalid' is a reserved non-production placeholder (an RFC 2606 reserved TLD): substitute the customer's data-center API host before enabling, in every endpoint, in the resource locators and in every egress allowlist entry — the allowlist matches exactly, so all three must be substituted together, and substitution is a required deployment step. If the data-center API port is not 443, the deployment must also review the port: the egress allowlist entry here is the authority only. AUTHENTICATION: the retrieved boilerplate calls the REST API with browser session credentials (fetch credentials: 'include') from an already-logged-in Five9 VCC session — the retrieved material does not document a token-based scheme for this API, and the pack's credential note registers the session cookie honestly as a vault-held, externally-refreshed value rather than pretending a bearer scheme was verified; whether the gated developer guide documents HTTP Basic or token auth for server-side callers is an open review item. Tiering rationale: calls.make_external places a live outbound call to an end recipient and is registered as create and send at the R3 floor — send is one of the IRREVERSIBLE ACTIONS (delete, send, pay, deploy, approve, share and transfer). calls.dispose finishes a call and sets its disposition per the retrieved starter-kit wording; whether disposal terminates an active call in every documented state is unverified against the gated guide — this pack treats it as hanging up a live customer interaction. The action floor for update is R2, but ending an in-progress customer call cannot be undone, so this pack registers it at R3 on effect. Documented exclusions — this pack does not register: the Configuration Web Services API and Statistics Web Services (separate SOAP admin and reporting surfaces, excluded outright); call-recording views and recording downloads (POST /supsvcs/rs/svc/supervisors/{id}/agents/{id}/recording_views — bulk access to recorded customer conversations); contact record deletion and DNC (do-not-call) list mutations; campaign start/stop and list loading (admin operations driving mass outbound dialing); supervisor monitoring, whisper and barge-in on live calls; and the WebSocket event channels — each is a different registration requiring its own review, and none is approximated here.

Draft review record dated 2026-09-21 · Reviewer: aaes-eng (an opaque id that resolves internally to the responsible reviewer)

• https://github.com/Five9DeveloperProgram/Five9-Agent-Sup-REST-API-Starter-Kit (retrieved 2026-09-21)
• https://raw.githubusercontent.com/Five9DeveloperProgram/Five9-Agent-Sup-REST-API-Starter-Kit/main/README.md (retrieved 2026-09-21)
• https://raw.githubusercontent.com/Five9DeveloperProgram/Five9-Agent-Sup-REST-API-Starter-Kit/main/agent_VCC_boilerplate.html (retrieved 2026-09-21)
• https://cdn.prod.us.five9.net/stable/crm-sdk-lib/doc/ (retrieved 2026-09-21)

A pack review is not a vendor or examiner attestation. A retrieval date says when a source page was read; it does not by itself establish what the page said then. No pack is vendor-endorsed, and none has been connectivity-tested against a live vendor tenant.