---
name: "3CX PBX Admin & Diagnostics"
description: >
  3CX's system-and-configuration surface: server time, PBX event log and
  application log search, service status, database schema and the
  read-only SELECT-only Query tool, DIDs, IP and phone blocklists, SIP
  trunks, call flow apps, and the configuration write/delete actions that
  change what calls the PBX accepts or how they route.
when_to_use: >-
  When diagnosing a PBX-level issue, auditing PBX configuration, running a
  read-only query against PBX data, or changing blocklist, blacklist, or
  DID assignment. Use when: 3cx diagnostics, 3cx event log, 3cx services,
  3cx query, 3cx blocklist, 3cx blacklist, 3cx did, 3cx sip trunk, or 3cx
  call flow.
---

# 3CX PBX Admin & Diagnostics

## Overview

This is the plugin's system-level surface: diagnostics, the PBX's own
configuration inventory, a restricted database query tool, call flow app
details, and the smaller set of write/delete actions that change what
calls the PBX will accept or how they route.

## Read-Only Capabilities

Exact tool names are not published by 3CX — see the `api-patterns` skill
and call `tools/list` for the authoritative names on a connected PBX.

**System and diagnostics**

- Get current PBX server time
- Search/list structured PBX event log
- List PBX services and their state
- Search application logs

**PBX inventory and database**

- Describe a database table's schema
- List DIDs
- List IP blocklist entries
- List configured PBX peers
- List phone blacklist entries
- List accessible database tables
- List configured SIP trunks
- Run a read-only SQL `SELECT` query (the `Query` tool)

**Call flow tools**

- Get a call flow app's details
- Get a call flow app's files
- Get an edit URL for a supported PBX object
- List call flow apps

### The Query tool

The `Query` tool is hard-restricted server-side to read-only SQL `SELECT`
statements, regardless of the connecting account's 3CX role — this holds
even for an account that could otherwise change configuration. That
restriction is enforced inside the PBX itself.

It is *not* automatically safe from a Conduit-permission standpoint,
though, if this PBX is reached through Conduit's BYO connector rather than
a direct connection: Conduit's tiering heuristic reads the tool's *name*,
not the PBX's server-side enforcement. See the `api-patterns` skill's
section on BYO tool tiering — if the tool's real name doesn't start with a
recognized read verb, Conduit will still gate it as `write`. Check the
tool's actual granted tier rather than assuming `SELECT`-only implies
`read`.

## Write/Delete Capabilities — Read This Before Calling Any of Them

- Add an IP address to the IP blocklist
- Add a number to the phone blacklist
- Assign a DID
- Remove an IP blocklist entry
- Remove a phone blacklist entry

These directly change what calls and traffic the PBX accepts. An
incorrect IP blocklist entry can cut off a legitimate SIP trunk or a
remote worker's softphone. An incorrect DID assignment can silently
misroute inbound calls for an entire department, and nobody notices until
a customer calls in complaining the call never arrived. Treat these
exactly like any other production network-ACL or routing change: confirm
the exact value — the IP, the number, the DID — with the requester before
calling, and don't let a scheduled or unattended agent apply them.

## Common Workflows

### PBX health check

1. Get current PBX server time (confirms basic connectivity/liveness).
2. List PBX services and their state.
3. Search the structured event log for the recent window, looking for a
   pattern rather than a single isolated entry.

### Audit inbound call routing

1. List DIDs.
2. List call flow apps and get the details of any that own a DID under
   review.
3. Cross-reference against the queues/departments the DID should reach
   (see the `calls-queues` skill).

### "Why is this number blocked?"

1. List phone blacklist entries and IP blocklist entries.
2. If the number or IP is present and shouldn't be, remove it — confirm
   the exact value with the requester first; this is a write action.

### Ad hoc read-only report

1. List accessible database tables, then describe the relevant table's
   schema before writing a query.
2. Run the query through the `Query` tool. It can only `SELECT` — there is
   no path from this tool to a data change.

## Gotchas

- **`Query` is `SELECT`-only inside the PBX no matter what** — but don't
  assume that guarantees a `read` tier if this PBX is reached through
  Conduit's BYO connector (see above).
- **The call-flow "edit URL" tool hands back a link into the PBX's own web
  UI.** Treat it like any other admin-console link — something a human
  reviews and clicks, not something to feed into further automation
  unreviewed.
- **This is Alpha software** (3CX V20 Update 10 Alpha). Configuration tool
  behavior in particular is worth re-verifying against a real PBX rather
  than trusting this description months after it was written.

## Related Skills

- [API Patterns](../api-patterns/SKILL.md) — connection setup, permission inheritance, and BYO tool tiering
- [Calls, Queues & Profiles](../calls-queues/SKILL.md) — department/queue membership this configuration feeds into