Hey Support, I need some help with a Genesys Cloud BYOC PBX SIP trunk integration that keeps returning 403 Forbidden on outbound calls. Call IDs for your logs: - 5952b4cd-882e-123f-dd83-0ec59d486a0b - 45cbea0c-882f-123f-7da3-06ce18bd6143 Error I'm getting: { "status": "ended", "endedReason": "call.in-progress.error-providerfault-outbound-sip-403-forbidden", "phoneCallProviderDetails": { "sipReason": "Forbidden", "sipStatus": 403 } } Genesys setup: - Region: US West (usw2.pure.cloud) - Trunk type: Generic BYOC PBX - Trunk has a unique org-specific FQDN ([unique-id].byoc.usw2.pure.cloud) - Protocol: UDP - PSTN carrier: Peerless assigned in Default Outbound Route - PBX Passthrough: enabled - SIP Access Control: 44.229.228.186 and 44.238.177.138 whitelisted - SIP Servers/Proxies: both VAPI IPs on port 5060 Initial VAPI credential config: { "provider": "byo-sip-trunk", "gateways": [{ "ip": "lb01.voice.usw2.pure.cloud", "port": 5060, "inboundEnabled": false, "outboundEnabled": true }], "outboundLeadingPlusEnabled": true } Things I tried that didn't work: 1. Gateway pointing to Genesys shared load balancer (lb01.voice.usw2.pure.cloud) 2. Gateway pointing to the trunk-specific FQDN ([unique-id].byoc.usw2.pure.cloud) 3. Gateway pointing to all 4 IPs resolved from the trunk FQDN (52.32.193.99, 52.33.193.56, 54.244.22.120, 34.211.206.63) All attempts give the same 403. I also enabled Protocol Capture on the Genesys trunk but can't find where the logs are in the UI so i can't see the raw SIP trace. Any idea what I'm missing? Happy to share more details.

A 403 usually means Genesys is receiving the INVITE but rejecting it at the trunk or auth level, not a network issue. With BYOC PBX this is often an IP auth mismatch, trunk association issue, or header validation problem (From/PAI), especially with PBX Passthrough enabled. Is your trunk set to strict IP authentication only, or does it also expect SIP digest credentials? @Zoom

Hey, thanks for the detailed writeup. The 403 is coming from Genesys, not from Vapi. The most likely cause is an IP mismatch on your SIP Access Control - the IP that the SIP INVITE is actually arriving from may not match the two IPs you've whitelisted, and Genesys will reject it immediately. To confirm this, we need to see the raw SIP trace. For the Protocol Capture logs in Genesys - go to Admin > Telephony > Trunks > click your BYOC PBX trunk, then look for a Diagnostics or Protocol Capture tab. The trace will show the source IP in the Via or Contact header of the INVITE, and the 403 response will confirm the rejection reason. If you can grab that and share it here, I can tell you exactly what's happening.

@Zoom Pardon me for jumping in, I'm mildly familiar with Genesys Cloud and I can tell you that the chances of that working are very low. To properly connect with Genesys cloud, you should use an SBC type service, such as Cloudonix or Jambonz, that will "hide" VAPI's internal dynamic nature that bounces servers.

Hi James, i tried both strict IP authentication and SIP digest credentials

@Zoom Are you still having issues with this ?

Im able to call from VAPI to Genesys cloud via byoc pbx trunk. ensure the ff: 1. outbound only is selected in vapi gateway config 2. enable pbx passthrough 3. add vapi IPs to sip control on genesys trunk (44.229.228.186, 44.238.177.138) 4. add your genesys trunk's domain in vapi gateway(e.g. mycompanyname.byoc.euw1.pure.cloud)