00 · Header

T4 · Webex Contact Center Enterprise

Finesse Desktop & Gadgets

Gateway Enterprise T4-R06 PSTNCVPRouterDesktop
Illustrated scene for Finesse Desktop & Gadgets. Original drawing, not a product screenshot.
Sequence · PSTN → CVP → Router → Desktop PSTNCVPRouterDesktop 123
Color-coded sequence: PSTN → CVP → Router → Desktop. A packet moves along the arrows. Reduced motion keeps every step visible.

Cisco Finesse is the browser desktop in the Unified CCE and Webex CCE guides. The layout is XML. Failover is a CTI reconnect, not a gadget refresh.

Room T4-R06 Version v0.1 last-verified: TODO Difficulty L3 Est. time 80–100 min Prereq T4-R01 Reading 20 min

01 · Executive summary

Five lines, then why it matters

  • Finesse gadgets are applications inside one desktop. Third-party gadgets can live on the 3rdpartygadget web application or on an external server. [cite:1]
  • REST calls from a gadget to an external service are proxied through Shindig. The gadget still has to authenticate to that third-party service itself. [cite:1]
  • The layout XML has an Agent role and a Supervisor role. A supervisor tab is added under the Supervisor tag. [cite:1]
  • Finesse misses failover detection after three missed CTI heartbeats. The heartbeat interval is five seconds. [cite:4]
  • If a desktop client’s reconnect takes longer than 2 minutes, Finesse signs the agent out. [cite:6] re-check
Why it matters. Multi-tenant Agent Desktop layouts are T3-R04. This room is the Finesse administration guide: XML layout, 3rdpartygadget, and CTI failover. Mixing the two desktops produces a design you cannot click.

02 · Architecture map

Layout XML, then the CTI pair

  • 1One XML file, two roles
  • 2Relative path or absolute URL
  • 3A-side and B-side CTI
Mermaid source (not rendered)
flowchart LR
  XML[Layout XML] --> Desk[Finesse desktop]
  Desk --> CTIA[CTI A]
  Desk --> CTIB[CTI B]
  Gadget[3rdpartygadget] --> Desk

03 · Core concepts

XML, proxy, and duplex

OpenSocial gadget

Cisco Finesse is an OpenSocial gadget: an XML document that defines metadata for an OpenSocial gadget container. Gadgets are the applications placed on the desktop so the agent can service calls inside one application. [cite:1]

Shindig proxy

Gadgets can make REST requests to external servers through the Cisco Finesse JavaScript library. To avoid browser cross-origin issues, those requests are proxied through the Shindig web application. Third-party gadgets must implement their own authentication for third-party REST services. [cite:1]

Production CTI pair

The B-side host and port fields are not shown as required in the UI. The administration guide still says A-side and B-side CTI servers are mandatory for a production deployment of Unified CCE and Cisco Finesse. The CTI server runs on the PG. [cite:5]

Test Connection

If Test Connection succeeds for one side and fails for the other, the guide calls that a valid configuration because the CTI server works active-passive and the inactive node refuses the CTI port. Success on both sides at once is an error to investigate. Test Connection does not prove the peripheral is online. It validates that the peripheral is configured in Unified CCE. [cite:5]

Failover timings the guide prints

ItemPrinted valueCite
Heartbeat intervalFive seconds. Three consecutive misses count as a lost CTI connection.[cite:4]
State during failoverOUT_OF_SERVICE. Requests get 503. No client events go out.[cite:4]
After reconnectIN_SERVICE. Last call control, call data, and agent state are published.[cite:4]
Call contained inside the failover windowCorresponding events are not published.[cite:4]
Agent PG 12.5(1) or laterCTI failover varies approximately from 35 to 75 seconds, as a guideline.[cite:4]
Non-voice MRD on CTI disconnectAgent state changes to WORK on that MRD so tasks are not routed to the disconnected agent.[cite:4]
Desktop reconnectIf reconnect takes longer than 2 minutes, Finesse signs the agent out.[cite:6] re-check
Tomcat restartChanges on the CTI Server Settings gadget require a restart of Cisco Finesse Tomcat on all nodes. Agents sign out and sign in again.[cite:5]

04 · Ecosystem

What sits beside the desktop

PSTNCVPRouterDesktop This room
Mini map of the neighbors named on this room’s sequence. Orientation sketch, not a new product claim.

Glossary

Finesse
The OpenSocial gadget container documented in the Cisco Finesse Administration Guide, Release 15.0(1). [cite:1]
Manage Desktop Layout
The administration gadget used to upload the XML layout for agents and supervisors. [cite:1]
3rdpartygadget
The web application on the Finesse server that hosts uploaded third-party gadget files. [cite:1]
Shindig
The backend that proxies gadget REST calls so the browser does not make a cross-origin call directly. [cite:1]
CTI server
Runs on the peripheral gateway. Finesse is configured with an A side and a B side. [cite:5]
Peripheral ID
The Agent PG routing client ID. The guide says it should be the same value for the A-side and B-side CTI servers. [cite:5]
OUT_OF_SERVICE
Finesse state while CTI failover is in progress. [cite:4]
IN_SERVICE
Finesse state after it reconnects to a CTI server and will again answer clients and publish events. [cite:4]
Manage Digital Channels
A gadget path the default layout comments include for digital channels. The what’s-new page points at the gadget user guide. [cite:1] [cite:7]
FIPPA
Finesse IP Phone Agent. The March 2022 VPN-less note says FIPPA is not supported on that internet path. [cite:7] re-check
Multi-tenant Agent Desktop
The Webex Contact Center desktop in T3-R04. It is not this XML layout. [cite:8]
Conference caveat
An agent on a conference with devices that are not other agents or supervisors can see unpredictable desktop notifications across a failover. Phone operations can continue. The desktop returns to usual after the agent drops the conference. [cite:4]

Mind map

Mermaid source (not rendered)
mindmap
  root((Finesse))
    Layout XML
    CTI pair
    Third-party gadgets

Sister matrix

Orientation only. No help.webex.com parity matrix maps Finesse gadgets to another vendor’s desktop.
SisterWhat the cited page saysWhy it mattersConfig touchpointTypical failureCite
Workforce managementpy6u9h lists WFO SKUs for Enterprise, CCE, and CCX. The Finesse layout chapter does not install WFM.A gadget can display a schedule. It does not become the WFM product.SKU article, then whatever gadget URL that product documents.Pasting a WFM URL into the layout and calling the SKU installed.[cite:9]
Quality management and recordingNot defined as a retention number in the layout chapter.Recording controls and QM retention are different guides.Read the recording guide for the release you run.Using a gadget height as a retention setting.[cite:1]
E911, RAY BAUM, Kari, RedSkyThe Finesse failover chapter does not configure 911.Desktop sign-out is not a location update.Read the Webex CCE 9-1-1 section the what’s-new page names.Proving emergency calling by watching the agent state.[cite:7] re-check
Analytics and reportingCUIC is the reporting platform in the UCCE reporting guide. Live Data gadgets are a CUIC concern.A failed gadget is not a failed historical report.T4-R07 for stock reports. Certificates for Live Data are a Finesse admin chapter title.Restarting Tomcat to fix a report definition.[cite:10]
Salesforce, Dynamics 365, ServiceNowNot named as installers in the layout chapter read here. Third-party gadgets use your own authentication.Screen-pop is a gadget plus a CRM login.Upload the gadget, then implement that service’s auth. Dynamics 365 Contact Center is a different product from Cisco’s connector.Expecting Shindig to log the agent into the CRM.[cite:1]
Virtual agents and AI AssistantThe default layout comments include paths for answers and transcript gadgets under ccaiGadgets, marked hidden in the sample.A commented gadget is not enabled.Unhide the gadget in the layout only when that CCAI guide says to.Teaching a hidden sample URL as a live bot.[cite:1]
IVR and self-serviceCall Studio is T4-R05. Finesse shows the agent the result of routing.A gadget cannot replace SendToVRU.CVP configuration guide for the IVR. Finesse for the desktop.Debugging VoiceXML inside the layout XML.[cite:1]
Digital channelsThe sample layout includes ManageDigitalChannel.xml. What’s-new names email, chat, SMS, and later WhatsApp and Facebook Messenger.Digital is a gadget, not a second Finesse product.The gadget user guide linked from nhy3hvdb.Adding the XML and skipping the channel configuration that guide describes.[cite:1] [cite:7]
Identity and SSOThird-party gadgets authenticate themselves. Finesse administration is a separate sign-in.SSO for the Webex org does not fill a gadget’s CRM token.Control Hub SSO for the Webex identity. Gadget auth in the gadget.One password reused across Shindig, CRM, and CTI.[cite:1]

Integration edges

FromToMechanismWhat movesCite
AdministratorManage Desktop LayoutXML uploadAgent and Supervisor layouts[cite:1]
Finesse serverGadgetRelative pathA file such as /3rdpartygadget/files/HelloWorld.xml[cite:3]
External hostGadgetAbsolute URLA gadget that does not live on the Finesse server[cite:2]
GadgetExternal RESTShindig proxyThe request. Auth stays in the gadget.[cite:1]
FinesseCTI A or CTI BCTI connectionCall and agent events. Failover alternates servers.[cite:4]
CTI settings changeFinesse TomcatService restartAgents must sign in again[cite:5]
Desktop clientEither Finesse serverReconnectSign-out if the design-guide timer of 2 minutes is exceeded[cite:6]
Internet path, March 2022 noteFinesse desktopVPN-less accessFIPPA is excluded. Multiple devices through NAT are excluded.[cite:7] re-check

Bridges

Finesse ideaNeighborPeer labelCite
XML desktop layoutMulti-tenant Webex Contact Center uses Agent Desktop. Read T3-R04 for that product.No published parity with other vendors’ agent desktops.[cite:8]
CTI on the PGOn-premises UCCE duplex is the prerequisite the failover chapter names.A cloud calling softphone is not this CTI pair.[cite:4]
Third-party gadgetUpload to 3rdpartygadget or host it elsewhere with an absolute URL.A CRM vendor’s widget is orientation until that vendor’s guide is cited.[cite:3]

Future hooks

  • Canon plan: re-read the failover timings when a Finesse guide newer than the December 12, 2025 update is published.
  • The 2-minute sign-out is in the Solution Design Guide updated March 15, 2025. Keep the re-check until that chapter is inside 12 months.
  • Unhide CCAI gadgets only after the Contact Center AI gadget guide for that release says the service is on.

Ecosystem troubleshooting

SymptomLikely mix-upCheckMoveCite
A multi-tenant layout screen is used to upload Finesse XMLT3 Agent Desktop was opened for a Finesse serverWhich administration guide matches the hostname?Use Manage Desktop Layout on Finesse.[cite:1]
CRM calls fail from the gadget with a browser errorThe gadget called the CRM origin directlyShindig is the proxy. The gadget still owns auth.Use the Finesse JavaScript library path the guide describes.[cite:1]
Both CTI tests succeed at the same timeThe guide calls that a configuration errorActive-passive: the inactive node refuses the portFix the host and port pair. Do not celebrate the double success.[cite:5]
FIPPA is in a VPN-less design from the 2022 noteThat note excludes FIPPAThe what’s-new considerations listKeep FIPPA off that path until a newer page says otherwise.[cite:7]

05 · Flow

From XML upload to a failover

StepFromToProtocolNotesCite
1AdministratorManage Desktop LayoutXML uploadDefines gadgets for the Agent role and the Supervisor role.[cite:1]
2LayoutFinesse serverRelative pathExample in the third-party chapter: /3rdpartygadget/files/HelloWorld.xml.[cite:3]
3LayoutExternal serverAbsolute URLRequired when the gadget is not hosted on Finesse.[cite:2]
4FinesseCTI serverCTIA side and B side. Same peripheral ID. Duplex Unified CCE.[cite:4] [cite:5]
5CTI serverFinesseHeartbeatFive-second interval. Three misses, or a failed socket, starts failover.[cite:4]
6FinesseDesktopHTTP 503OUT_OF_SERVICE. No events are sent.[cite:4]
7FinesseOther CTI serverAlternateIt tries the servers until one connection succeeds.[cite:4]
8FinesseClientsEventsIN_SERVICE publishes the last call control, call data, and agent state.[cite:4]

06 · Config

Settings you can cite

  1. Open Manage Desktop Layout and upload an XML file. Keep an Agent role block and a Supervisor role block. [cite:1]
  2. For a gadget file you uploaded to the Finesse server, add a relative path under /3rdpartygadget/files/. [cite:3]
  3. For a gadget on another host, use a fully qualified URL. [cite:2]
  4. On the primary Finesse server, open Contact Center Enterprise CTI Server Settings. Enter A-side host and port, B-side host and port, and the Agent PG peripheral ID. Use the same peripheral ID on both sides. [cite:5]
  5. The CTI host is typically the PG, because the CTI server runs on the PG. B-side port accepts 1 through 65535 and must match the CTI server setup. [cite:5]
  6. Use Test Connection. One side succeeding is valid. Both succeeding together is a problem to fix. The test does not prove the peripheral is online. [cite:5]
  7. After any CTI settings change, restart Cisco Finesse Tomcat on all nodes. Do that when agents are signed out. They must sign in again after the restart. [cite:5]

Screenshot slot: Manage Desktop Layout with hostnames and gadget URLs redacted.

07 · Limits

Timers and rules

ItemValueSourceVerified?
CTI heartbeat5 seconds; 3 misses[cite:4]Quoted. Guide updated December 12, 2025
Failover HTTP status503 Service Unavailable[cite:4]Quoted
PG 12.5(1) or later guidelineAbout 35 to 75 seconds[cite:4]Quoted as a guideline, not a promise
B-side port range1–65535[cite:5]Quoted
Production CTI sidesA and B are mandatory[cite:5]Quoted
Desktop reconnect before sign-out2 minutes[cite:6]re-check Design guide updated March 15, 2025
VPN-less FIPPA and NATFIPPA not supported. Multiple devices via NAT not supported.[cite:7]re-check March 2022 note
Windows 11 clientWhat’s-new says Windows 11 64-bit for Finesse desktop, Call Studio, and Reporting[cite:7]re-check July 2023 note

08 · Troubleshooting

Layout, proxy, and CTI

SymptomLikely causeEvidenceFixCite
Gadget file 404 on the desktopRelative path does not match the uploadThird-party chapter example uses /3rdpartygadget/files/Match the XML path to the uploaded file[cite:3]
External gadget never loadsA relative path was used for an off-box hostDevNet layout note: off-box gadgets need a fully qualified URLUse an absolute URL[cite:2]
CRM returns a browser cross-origin errorThe gadget did not go through the library proxyShindig proxies REST. The gadget still authenticates.Use the JavaScript library path. Add the service’s own auth.[cite:1]
Desktop shows the server unavailable and API calls failCTI failover in progressOUT_OF_SERVICE and HTTP 503Wait for IN_SERVICE. Do not treat 503 as a gadget bug.[cite:4]
Only one CTI side was configuredThe UI did not mark B side requiredThe guide says both sides are mandatory in productionConfigure B-side host and port[cite:5]
Test Connection succeeds on A and B togetherThe guide says that pattern is an errorInactive CTI node should refuse the portCorrect the host and port entries[cite:5]
Agents drop after a CTI editTomcat was restartedThe guide says agents must sign in againRestart when nobody is signed in[cite:5]
A call that lived only inside the failover has no eventsExpectedThe failover chapter says those events are not publishedExplain the gap. Do not hunt a missing gadget event for that call.[cite:4]
Conference participants disappear after failoverThe conference caveatNon-agent devices on the conference can yield bad notificationsPhone operations can continue. Desktop behavior returns after the agent leaves the conference.[cite:4]
Agent is signed out after a long reconnectThe design-guide timerLonger than 2 minutesThe agent signs in again when the client reconnects[cite:6]

09 · Self-question ladder

Twelve rungs

L0What is a Finesse gadget?

An OpenSocial XML document placed on the Finesse desktop. [cite:1]

L1Why does the layout have two role blocks?

The XML defines the desktop for agents and for supervisors. Supervisor-only tabs go under the Supervisor tag. [cite:1]

L1What fails if a third-party gadget assumes Finesse will log it into the CRM?

The guide says the gadget must implement its own authentication for third-party REST services. Shindig only proxies the call. [cite:1]

L2How does a gadget file on the Finesse server get referenced?

A relative path. The third-party chapter’s example is /3rdpartygadget/files/HelloWorld.xml. [cite:3]

L2When is an absolute URL required?

When the gadget is hosted on a server other than the Finesse server. [cite:2]

L2What are the duplex prerequisites for CTI failover?

Unified CCE in duplex mode, and the B-side CTI host and port configured in Finesse administration. [cite:4]

L3How do you prove a 503 is failover rather than a bad gadget?

Finesse is OUT_OF_SERVICE and does not send events. After IN_SERVICE it publishes the last call control, call data, and agent state. [cite:4]

L3Why can Test Connection fail on one side and still be valid?

CTI is active-passive. The inactive node refuses the CTI port. Both sides succeeding together is the error case. [cite:5]

L3What does a CTI settings change do to signed-in agents?

You restart Finesse Tomcat on all nodes. Agents sign out and sign in again. [cite:5]

L4How is this desktop different from multi-tenant Agent Desktop?

This room follows the Finesse administration guide. Multi-tenant Agent Desktop is a different product surface, covered in T3-R04. [cite:8]

L4What does the March 2022 VPN-less note exclude?

FIPPA, and multiple devices accessing the desktop through NAT. The note is older than 12 months. [cite:7] re-check

L5What constraint stops you from promising every conference will redraw cleanly after failover?

The failover chapter says conferences that include devices not associated with another agent or supervisor can produce unpredictable desktop notifications. The phone can still be used. The desktop returns to usual after the agent drops the conference. [cite:4]

10 · Lab

Paper lab: read a layout and a CTI pair

11 · Quiz

Twelve checks

0 revealedAnswers stay closed until you open them.
Q1MCQ

A Finesse gadget is:

  1. An OpenSocial XML document
  2. A CUIC report definition
  3. A CVP Call Studio element
  4. A BGP community
Reveal

A. [cite:1]

Q2MCQ

Manage Desktop Layout uploads XML for:

  1. Agents and supervisors
  2. Only supervisors
  3. Only the publisher
  4. Partner Hub
Reveal

A. [cite:1]

Q3Scenario

You uploaded HelloWorld.xml onto the Finesse server. Which path does the third-party chapter show?

Reveal

/3rdpartygadget/files/HelloWorld.xml inside the Agent and Supervisor layouts. [cite:3]

Q4MCQ

A gadget hosted on another server must be:

  1. A fully qualified URL
  2. A relative path
  3. A peripheral ID
  4. A /30
Reveal

A. [cite:2]

Q5MCQ

Shindig’s job in this chapter is:

  1. Proxy REST so the browser avoids a cross-origin call
  2. Authenticate the CRM
  3. Route PSTN
  4. Store CUIC reports
Reveal

A. The gadget still authenticates to the third-party service. [cite:1]

Q6Scenario

During CTI failover, a gadget API call returns an error. Which status does the guide name?

Reveal

503 Service Unavailable, while Finesse is OUT_OF_SERVICE. [cite:4]

Q7MCQ

CTI failover prerequisites include:

  1. Duplex Unified CCE and a configured B-side CTI host and port
  2. A single CTI server only
  3. Flow Designer
  4. Standalone CVP
Reveal

A. [cite:4]

Q8MCQ

Three missed heartbeats means the interval in the guide is:

  1. Five seconds
  2. One minute
  3. Two minutes
  4. 24 hours
Reveal

A. [cite:4]

Q9Scenario

Test Connection works on side A and fails on side B. Is that automatically a broken pair?

Reveal

No. The inactive CTI node refuses the port. The administrator still needs a valid host and port on the failed side. Both sides succeeding together is the error case. [cite:5]

Q10MCQ

The Agent PG peripheral ID on A and B should be:

  1. The same value
  2. Different on purpose
  3. Empty on B
  4. A public ASN
Reveal

A. [cite:5]

Q11Draw it

Draw Finesse alternating between two CTI servers until one connects. Label the state names.

Reveal

OUT_OF_SERVICE while it alternates. IN_SERVICE after a successful connection. [cite:4]

Q12Scenario

A client takes longer than 2 minutes to reconnect. What does the design guide say Finesse does?

Reveal

It signs the agent out. The agent signs in again when the client reconnects. The chapter date is March 15, 2025, so this stays re-check. [cite:6]

12 · Audio

Slots for Studio

Transcript slot

Studio fills this from the cites.

Transcript slot

Studio fills this from the cites.

Transcript slot

Studio fills this from the cites.

13 · Interview

Oral answers

30 seconds. Finesse is an OpenSocial desktop. I upload one XML layout with an Agent role and a Supervisor role. Gadgets on the server use a relative path under 3rdpartygadget. Gadgets elsewhere use an absolute URL.

2 minutes. CTI failover needs duplex Unified CCE and both CTI sides. The CTI server runs on the PG, and both sides use the same peripheral ID. Three missed five-second heartbeats, or a dead socket, moves Finesse to OUT_OF_SERVICE. Clients get 503 and no events. Finesse alternates servers until one connects, then publishes the last call and agent state. A call that begins and ends inside that window is not published. Test Connection may fail on the passive side. Both sides succeeding at once is the case I investigate.

30 seconds, auth. Shindig proxies the REST call. The gadget still logs into the third-party service itself.

2 minutes, timers I date. The heartbeat and the 503 are in the administration guide updated December 12, 2025. The two-minute desktop sign-out is in the Solution Design Guide updated March 15, 2025, so I mark it re-check. The VPN-less exclusions for FIPPA and NAT are a March 2022 what’s-new note, also re-check.

What you will not say. You will not configure this XML from the multi-tenant Agent Desktop screen. That desktop is a different product.

14 · Citations

Ledger

Retrieved 2026-10-14. Study notes from public sources.

  1. Cisco Finesse Administration Guide, Release 15.0(1), Manage Desktop Layout — cisco.com — updated December 12, 2025 — Manage Desktop Layout. OpenSocial XML. Shindig proxy. Agent and Supervisor roles. 3rdpartygadget hosting.
  2. LayoutConfig — developer.cisco.com Finesse — LayoutConfig. Relative path on the Finesse server. Fully qualified URL off the server.
  3. Cisco Finesse Administration Guide, Release 15.0(1), Manage Third-Party Gadgets — cisco.com — Manage Third-Party Gadgets. Example path /3rdpartygadget/files/HelloWorld.xml.
  4. Cisco Finesse Administration Guide, Release 15.0(1), Cisco Finesse Failover Mechanisms — cisco.com — updated December 12, 2025 — Failover mechanisms. Duplex, OUT_OF_SERVICE, 503, five-second heartbeat, 35–75 second guideline, conference caveat, non-voice WORK state.
  5. Cisco Finesse Administration Guide, Release 15.0(1), Manage System Settings — cisco.com — CTI Server Settings. A and B mandatory in production. Same peripheral ID. Test Connection. Tomcat restart.
  6. Solution Design Guide for Cisco Unified Contact Center Enterprise, Release 15.0(1), High Availability and Network Design — cisco.com — updated March 15, 2025 — High availability. Reconnect longer than 2 minutes signs the agent out. re-check
  7. What’s new for administrators in Webex Contact Center Enterprise — help.webex — article nhy3hvdb — help.webex.com article nhy3hvdb. Digital channels. VPN-less Finesse considerations. Windows 11 client note. 9-1-1 pointer. re-check
  8. Webex Contact Center architecture — help.webex — article utqcm7 — help.webex.com article utqcm7. Multi-tenant architecture. Not the Finesse XML guide.
  9. Webex WFO: Feature Specific SKUs — help.webex — article py6u9h — help.webex.com article py6u9h.
  10. Cisco Unified Contact Center Enterprise Reporting User Guide, Release 15.0(1) — cisco.com — CUIC chapter. Reporting platform boundary. re-check

15 · Re-engineer later

Still open

  • Open questions: exact Agent PG 12.6 failover range beyond the “varies” sentence already in the failover chapter; live gadget-property screen after the July 2023 drag-and-drop note.
  • Facts still marked re-check: the 2-minute sign-out, the March 2022 VPN-less exclusions, and the July 2023 Windows 11 sentence.
  • Assets missing: redacted layout screenshot, audio, exported SVGs.
  • Ideas for v1.0: a one-page XML skeleton with the two roles and no sample credentials.
  • Next review: re-read the failover chapter if Cisco updates it after December 12, 2025.

Sources and go deeper

Checked links were opened this month. A confirm row has no address because that page was not opened.

sources.json for this page.