API reference / Webhooks
Webhooks
Events we send you, how they are signed, and how retries behave.
Register an endpoint in Settings → Webhooks and we POST events to it as they happen.
Events#
call.started— a call has begun.call.ended— a call finished and has been metered.booking.created— your AI took an appointment on a call.
Verifying a delivery#
Every request carries an x-signature header in the form t=<timestamp>,n=<nonce>,v1=<hmac>. The HMAC is SHA-256 over the canonical JSON of the payload, keyed with that endpoint’s own signing secret.
Verify by parsing the body, canonicalizing it, and recomputing — the byte order of the wire body deliberately does not matter, so a proxy that re-serializes your JSON cannot break verification.
Worth knowingVerify the signature rather than allowlisting IP addresses. Our sending addresses are not fixed, and a signature is the only proof that survives a change of infrastructure.
Retries#
- Up to six attempts over roughly 34 hours, with exponential backoff.
- An endpoint that keeps failing is disabled automatically, and the console says so.
- Every attempt — successful or not — appears in the delivery log.
- Deduplicate on the event id: the same event can legitimately arrive twice.