---
title: Leg Actions
slug: voice-apis/leg-actions
docTags: 
createdAt: 2026-01-19T11:20:38.399Z
---

# Description

Leg Actions allow you to **control an existing leg** after it has been created. Using these actions, you can answer, hang up, play audio, record, gather DTMF, stream audio, bridge calls, and more.

All leg actions are executed via a **single Actions API** using an **EXOML payload**.

## Authentication

- **Type:** HTTP Basic Authentication 
- **Username:** API Key 
- **Password:** API Token 

## Request Headers

:::BlockQuote
Content-Type: application/json
Authorization: Basic \<base64(API\_KEY\:API\_TOKEN)>
:::

## Request Body Structure

| Field                 | Type   | Required | Description                        |
| --------------------- | ------ | -------- | ---------------------------------- |
| exoml                 | string | Yes      | XML describing the action          |
| action\_custom\_param | string | No       | Custom value echoed back in events |

## Base URL

:::BlockQuote
https\://cpaas-api.in.exotel.com/v2/accounts/&#x7B;account\_sid}
:::

**Example**

:::BlockQuote
https\://cpaas-api.in.exotel.com/v2/accounts/ameyo5m
:::

## Common Endpoint

All Leg Actions are executed using:

**POST**

:::BlockQuote
/v2/accounts/&#x7B;account\_sid}/legs/&#x7B;leg\_sid}/actions
:::

**Full URL**

:::BlockQuote
https\://cpaas-api.in.exotel.com/v2/accounts/&#x7B;account\_sid}/legs/&#x7B;leg\_sid}/actions
:::

## Common Request Body

| Parameter             | Type   | Required | Description                                 |
| --------------------- | ------ | -------- | ------------------------------------------- |
| action\_custom\_param | string | No       | Custom value echoed back in external events |
| exoml                 | string | Yes      | EXOML XML defining the action               |

## Common Response

**HTTP 202 – Accepted**

:::BlockQuote
\{
&#x20; "request\_id": "abc123",
&#x20; "http\_code": 202,
&#x20; "response": \{
&#x20;   "data": \{
&#x20;     "leg\_sid": "LEG\_SID"
&#x20;   }
&#x20; }
}
:::

## Common Error Responses (applies to all actions)

| HTTP Code | Description                 |
| --------- | --------------------------- |
| 400       | Invalid EXOML or parameters |
| 401       | Authentication failed       |
| 403       | Not authorized              |
| 404       | Leg not found               |
| 429       | Rate limit exceeded         |
| 500       | Internal server error       |

## External Events (General)

- Events are delivered asynchronously to the configured leg\_event\_endpoint (gRPC).&#x20;
- Each action emits one or more action-specific events (listed in child pages).&#x20;