Webhooks

{  "event": "call.completed",  "data": {    "call_id": "call_a1b2c3",    "agent_id": "agt_x1y2z3",    "direction": "outbound",    "status": "completed",    "from_number": "+14155551234",    "to_number": "+14155559876",    "duration_seconds": 142,    "cost_total": 0.0231,    "error_message": null,    "started_at": "2025-11-01T14:30:00+00:00",    "ended_at": "2025-11-01T14:32:22+00:00",    "created_at": "2025-11-01T14:29:58+00:00"  },  "timestamp": "2025-11-01T14:32:22.123456+00:00"}

{  "event": "sms.received",  "data": {    "message_id": "sms_a1b2c3",    "conversation_id": "conv_x1y2z3",    "direction": "inbound",    "from_number": "+14155559876",    "to_number": "+14155551234",    "body": "Yes, tomorrow at 2pm works!",    "status": "received",    "contact_name": "Jane Doe",    "created_at": "2025-11-01T14:35:00+00:00"  },  "timestamp": "2025-11-01T14:35:00.500000+00:00"}

import hashlibimport hmacimport timedef verify(secret: str, headers: dict, raw_body: bytes) -> bool:    sig_header = headers["X-Webhook-Signature"]   # "t=1730470000,v1=abc...,v1=def..."    items = [p.split("=", 1) for p in sig_header.split(",")]    timestamp = next(v for k, v in items if k == "t")    # Reject stale timestamps to prevent replay (5 minute tolerance).    if abs(time.time() - int(timestamp)) > 300:        return False    signed = f"{timestamp}.".encode() + raw_body          # verify against the RAW body bytes    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()    # A delivery may carry multiple v1 signatures during a secret rotation.    provided = [v for k, v in items if k == "v1"]    return any(hmac.compare_digest(expected, v) for v in provided)

const crypto = require('crypto')function verify(secret, headers, rawBody /* Buffer */) {  const sigHeader = headers['x-webhook-signature']   // "t=...,v1=...,v1=..."  const items = sigHeader.split(',').map((p) => p.split('='))  const timestamp = items.find(([k]) => k === 't')?.[1]  // Reject stale timestamps to prevent replay (5 minute tolerance).  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false  const expected = crypto    .createHmac('sha256', secret)    .update(timestamp + '.')    .update(rawBody)                                 // verify against the RAW body bytes    .digest('hex')  // A delivery may carry multiple v1 signatures during a secret rotation.  const provided = items.filter(([k]) => k === 'v1').map(([, v]) => v)  return provided.some(    (v) => v.length === expected.length &&      crypto.timingSafeEqual(Buffer.from(v), Buffer.from(expected))  )}

<?phpfunction verify(string $secret, array $headers, string $rawBody): bool {    $sigHeader = $headers['X-Webhook-Signature'];   // "t=...,v1=...,v1=..."    $parts = [];    foreach (explode(',', $sigHeader) as $piece) {        [$k, $v] = explode('=', $piece, 2);        $parts[$k][] = $v;    }    $timestamp = $parts['t'][0] ?? '';    // Reject stale timestamps to prevent replay (5 minute tolerance).    if (abs(time() - (int) $timestamp) > 300) return false;    $expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);    // A delivery may carry multiple v1 signatures during a secret rotation.    foreach ($parts['v1'] ?? [] as $sig) {        if (hash_equals($expected, $sig)) return true;    }    return false;}