Webhooks

{  "event": "call.completed",  "data": {    "call_id": "call_a1b2c3",    "organization_id": "org_m4n5o6",    "agent_id": "agt_x1y2z3",    "direction": "outbound",    "status": "completed",    "from_number": "+14155551234",    "to_number": "+14155559876",    "duration_seconds": 142,    "cost_total": 0.0231,    "error_message": null,    "caller_name": "Dana Rivers",    "call_summary": null,    "user_sentiment": null,    "call_successful": null,    "phone_number_id": "pn_d4e5f6",    "answered_by_identity": null,    "routing": "none",    "answered_at": null,    "parameters": null,    "started_at": "2025-11-01T14:30:00+00:00",    "ended_at": "2025-11-01T14:32:22+00:00",    "created_at": "2025-11-01T14:29:58+00:00"  },  "timestamp": "2025-11-01T14:32:22.123456+00:00"}

{  "event": "sms.received",  "data": {    "message_id": "sms_a1b2c3",    "conversation_id": "conv_x1y2z3",    "direction": "inbound",    "from_number": "+14155559876",    "to_number": "+14155551234",    "body": "Yes, tomorrow at 2pm works!",    "status": "received",    "contact_name": "Jane Doe",    "organization_id": "org_m4n5o6",    "segments": 1,    "error_code": null,    "error_message": null,    "failure_reason": null,    "created_at": "2025-11-01T14:35:00+00:00"  },  "timestamp": "2025-11-01T14:35:00.500000+00:00"}

{  "event": "sms.opt_out",  "data": {    "contact_number": "+14155559876",    "billing_account_id": "org_m4n5o6",    "organization_id": "org_m4n5o6",    "origin_number": "+14155551234",    "keyword": "STOP",    "source": "inbound_sms",    "opted_out_at": "2025-11-01T14:40:00+00:00",    "opted_in_at": null,    "is_opted_out": true,    "scope": "billing_account"  },  "timestamp": "2025-11-01T14:40:00.250000+00:00"}

{  "event": "voicemail.left",  "data": {    "voicemail_id": "vm_a1b2c3",    "call_id": "call_a1b2c3",    "organization_id": "org_m4n5o6",    "phone_number_id": "pn_d4e5f6",    "from_number": "+14155559876",    "to_number": "+14155551234",    "duration_seconds": 18,    "transcript": "Hi, it's Dana. Please call me back.",    "transcription_status": "completed",    "is_read": false,    "created_at": "2025-11-01T14:45:00+00:00",    "caller_number": "+14155559876",    "duration": "0:18",    "voicemail_link": "https://jagcall.com/voicemails",    "voicemail_text": "Hi, it's Dana. Please call me back."  },  "timestamp": "2025-11-01T14:45:00.100000+00:00"}

{  "event": "contact.updated",  "data": {    "id": "c_a1b2c3",    "phone_number": "+14155559876",    "name": "Dana Rivers",    "email": "dana@example.com",    "company": "Rivers Plumbing",    "role": "Owner",    "address": null,    "notes": null,    "tags": "vip",    "is_favorite": false,    "created_at": "2025-11-01T14:29:58Z",    "updated_at": "2025-11-02T09:12:40Z",    "organization_id": "org_m4n5o6",    "changed_by": { "type": "user", "user_id": "usr_q7r8s9" },    "changed_fields": ["email"]  },  "timestamp": "2025-11-02T09:12:40.512000+00:00"}

import hashlibimport hmacimport timedef verify(secret: str, headers: dict, raw_body: bytes) -> bool:    sig_header = headers["X-Webhook-Signature"]   # "t=1730470000,v1=abc...,v1=def..."    items = [p.split("=", 1) for p in sig_header.split(",")]    timestamp = next(v for k, v in items if k == "t")    # Reject stale timestamps to prevent replay (5 minute tolerance).    if abs(time.time() - int(timestamp)) > 300:        return False    signed = f"{timestamp}.".encode() + raw_body          # verify against the RAW body bytes    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()    # A delivery may carry multiple v1 signatures during a secret rotation.    provided = [v for k, v in items if k == "v1"]    return any(hmac.compare_digest(expected, v) for v in provided)

const crypto = require('crypto')function verify(secret, headers, rawBody /* Buffer */) {  const sigHeader = headers['x-webhook-signature']   // "t=...,v1=...,v1=..."  const items = sigHeader.split(',').map((p) => p.split('='))  const timestamp = items.find(([k]) => k === 't')?.[1]  // Reject stale timestamps to prevent replay (5 minute tolerance).  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false  const expected = crypto    .createHmac('sha256', secret)    .update(timestamp + '.')    .update(rawBody)                                 // verify against the RAW body bytes    .digest('hex')  // A delivery may carry multiple v1 signatures during a secret rotation.  const provided = items.filter(([k]) => k === 'v1').map(([, v]) => v)  return provided.some(    (v) => v.length === expected.length &&      crypto.timingSafeEqual(Buffer.from(v), Buffer.from(expected))  )}

<?phpfunction verify(string $secret, array $headers, string $rawBody): bool {    $sigHeader = $headers['X-Webhook-Signature'];   // "t=...,v1=...,v1=..."    $parts = [];    foreach (explode(',', $sigHeader) as $piece) {        [$k, $v] = explode('=', $piece, 2);        $parts[$k][] = $v;    }    $timestamp = $parts['t'][0] ?? '';    // Reject stale timestamps to prevent replay (5 minute tolerance).    if (abs(time() - (int) $timestamp) > 300) return false;    $expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);    // A delivery may carry multiple v1 signatures during a secret rotation.    foreach ($parts['v1'] ?? [] as $sig) {        if (hash_equals($expected, $sig)) return true;    }    return false;}