Team overview

Path: /settings → Team tab

The Team tab surfaces the team's identity, resilience defaults, the base numbers assigned to it, team-scoped egress trunks and pools for outbound transfers, AWS Secrets Manager configuration for secret storage, and call recording configuration. Secrets Manager is the foundation for SECRET-type variables.

AccessReadMEMBER+EditADMIN+Saving the Team settings form requires ADMIN+, including changes to Call Recording.

Team info

Field	Editable	Description
Team Name	No	Set by a superadmin. Read-only here.
Members can publish Apps	ADMIN	When enabled, team MEMBER roles may publish apps. When disabled, only ADMIN / SUPERUSER can publish. See Draft and publish.

Base numbers

Lists base numbers assigned to your team by a superadmin. Per row:

Field	Editable	Description
Number	No	The phone number.
Description	No	Set by superadmin.
Header Manipulation Configs	ADMIN	Team-specific configs (multi-select). Default platform configs are applied separately.

AWS Secrets Manager

Field	Required	Description
AWS Region	Yes	Region where secrets live. Default eu-central-1.
Secrets Manager Key	Yes	Path/key for your team's secrets (default {ENVIRONMENT|NAMESPACE}/teams/<slug>/secrets).
AWS Assume Role ARN	No	Cross-account setups only. arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>. Empty if same account.
AWS Account ID	Auto	Extracted from Role ARN.
Complete ARN	Auto	Full Secrets Manager ARN with copy button.

Same-account vs cross-account

• Same-account — Delphi shares your AWS account. Only region + key required.
• Cross-account — Delphi assumes a role into your account. Each team's secrets isolated; CloudTrail audit on your side; you can revoke at any time.

For the IAM role setup, see AWS security setup.

Call recording

Field	Required	Description
Recording S3 Bucket	No	Bucket for recordings. Required if recording is used.
Recording AWS Region	No	Default eu-central-1.
Recording IAM Role ARN	No	Cross-account setups only.

A Team Admin saves the recording destination through this form. Members may see editable fields, but the complete form also submits administrative settings and requires ADMIN+ to save. Coordinate changes with the platform operator, who provides the bucket and AWS access. Recording artefacts must also be selected per app. Apps choose audio and transcript outputs independently.

Saving a non-empty bucket attempts to apply a 180-day S3 expiry rule. The settings save can succeed even if the lifecycle update fails, so the platform operator must verify the actual rule. TelWeb has no custom retention-period field. Changing the destination does not migrate existing recordings.

See Recording and transcript storage for user controls and the S3 recording storage reference for file layout, JSON schemas, and lifecycle details.

Resilience defaults

Team admins can either inherit the platform resilience defaults or enable a team override. The effective settings are merged in this order:

1. Platform defaults from Platform settings.
2. Team override on this tab, when enabled.
3. Flow-level provider and error-handling settings in the Flow Designer.

Use team overrides when one tenant needs different provider timeout/retry defaults, bot-delay comfort messages, or failover transfer/hangup behavior from the platform baseline. Leave the override off when the team should follow platform policy.

Provider defaults are resolved per role: STT, TTS, Realtime, and Bot/LLM. Configuring one role at team level replaces the complete platform block for that role; roles omitted from the team override continue to inherit. Include the timeout, retry count, delay, backoff, and Retry HTTP status codes values that the team role should keep.

The status-code field is a comma-separated allow-list for normal HTTP responses and WebSocket upgrade responses. The built-in list is 408, 429, 500, 502, 503, 504. For the exact decision rules and the interaction with flow-level provider overrides, see Provider retry policies.

Egress (outbound) routing

Team admins configure reusable outbound SIP routing for number transfers. The Egress section uses the same Trunks | Pools layout as platform admin, scoped to your team.

Sub-tab	What it manages
Trunks	Individual carrier or PBX destinations — SIP URI, transport, authentication, caller ID, codec preferences, and links to team base numbers.
Pools	Named routing sets that group one or more trunks for round robin or priority / failover transfer behavior.

Trunks are the building blocks; pools are what flows and failover policies reference by routing key (routeId). Full sip: or sips: URI targets bypass pool lookup and route by URI host instead.

How this connects to transfers

Outbound transfers need a path from Delphi to your carrier or PBX:

• Number or tel: targets — require egress. Set an Egress Base Number on the endpoint, then either link trunks to that base number or create a pool and select it in flow transfer settings (Egress route / routingPool). With no pool selected, the default base-number pool uses trunks linked directly to the base number.
• sip: / sips: targets — route by URI host; pools are not used for those transfers.
• Restrictions still apply — team transfer-restriction overrides and platform policy are checked before TelPro places the outbound leg.

Full runtime detail, failure modes, and Kamailio/Redis behavior are in Egress routing.

Pool and trunk changes auto-sync to TelPro. You do not need a manual re-sync after ordinary edits.

Typical team workflow

1. Create the trunks your carriers require (digest, registration, TLS mutual, and so on).
2. Open Pools → New → set Name, Route ID, base number, strategy, and member trunks with priorities.
3. Reference the pool from flow transfer settings.
4. Verify with a test transfer and inspect the conversation Debug tab SIP ladder.

Platform-wide egress objects (no team owner) are visible here when your deployment uses shared routing. SUPERUSERs manage those from Egress routing in Admin Settings.

Workflows

Configure Secrets Manager

1. Cross-account: finish the AWS security setup.
2. Set Region + Secrets Manager Key. Use Generate suggested key for {ENVIRONMENT|NAMESPACE}/teams/<slug>/secrets — keep keys unique per deployment when sharing an AWS account.
3. Set the Assume Role ARN (cross-account only).
4. Save and verify the Complete ARN.
5. You can now create SECRET variables.

Configure call recording

1. Enter the S3 bucket name (+ region if not the default).
2. Set the Recording IAM Role ARN (cross-account only).
3. Save.
4. Select the recording artefacts on each app that should retain audio or transcripts.

Historical screenshot unavailable

This historical screenshot is unavailable in the public archive. The written instructions for this release remain available below.

Settings → Team tab

Historical screenshot unavailable

This historical screenshot is unavailable in the public archive. The written instructions for this release remain available below.

Settings → Team tab → Egress → Pools sub-tab

See also

• Team default secrets — platform-managed OpenAI/Azure/WebRTC keys provisioned on team create.
• Egress routing — platform-wide trunks and pools (SUPERUSER).
• Variables and secrets — uses Secrets Manager.
• AWS security setup — IAM role setup.
• Header manipulation.