Webhook endpoints

8 endpoints. Every path below is relative to the API base URL and already includes the /api/v1 prefix — see conventions for authentication, pagination, errors and idempotency.

	Endpoint
GET	`/webhooks`	List webhook endpoints newest first, filterable by active state and by subscribed event
POST	`/webhooks`	Create a webhook endpoint and return its signing secret, the only time the secret is ever shown
GET	`/webhooks/{webhook}`	Retrieve one webhook endpoint; the signing secret is structurally absent from the payload
PUT	`/webhooks/{webhook}`	Update a webhook endpoint. The signing secret is not settable here
DELETE	`/webhooks/{webhook}`	Soft-delete a webhook endpoint and return an empty body
POST	`/webhooks/{webhook}/rotate-secret`	Rotate the signing secret and return the new one; the previous secret keeps signing for an overlap
POST	`/webhooks/{webhook}/test`	Queue a real signed test event so you can verify your signature check end to end
GET	`/webhooks/events`	List the webhook event types an endpoint can subscribe to, each with its label, group and volume flag

Endpoints

List webhook endpoints newest first, filterable by active state and by subscribed event

GET/webhooks

Requires webhook.read.

Query parameters

Name	Type	Required	Notes
`active`	boolean	—	default `false`

cURLJavaScriptPHPPython

bash

curl -X GET "$CALLAGENT_API_URL/webhooks?active=false" \
  -H "Authorization: Bearer $CALLAGENT_API_KEY" \
  -H "Accept: application/json"

const response = await fetch(`${process.env.CALLAGENT_API_URL}/webhooks?active=false`, {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${process.env.CALLAGENT_API_KEY}`,
    Accept: 'application/json',
  },
});

if (!response.ok) {
  const { error } = await response.json();
  throw new Error(`${error.type}: ${error.message}`);
}

const { data } = await response.json();

php

<?php

$handle = curl_init(getenv('CALLAGENT_API_URL') . '/webhooks?active=false');

curl_setopt_array($handle, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('CALLAGENT_API_KEY'),
        'Accept: application/json',
    ],
]);

$body = json_decode(curl_exec($handle), true);
$status = curl_getinfo($handle, CURLINFO_HTTP_CODE);
curl_close($handle);

if ($status >= 400) {
    throw new RuntimeException("{$body['error']['type']}: {$body['error']['message']}");
}

$data = $body['data'];

python

import os, requests

response = requests.get(
    f"{os.environ['CALLAGENT_API_URL']}/webhooks?active=false",
    headers={"Authorization": f"Bearer {os.environ['CALLAGENT_API_KEY']}"},
    timeout=30,
)
response.raise_for_status()
data = response.json()["data"]

Responses

Status	Body
`200`	Array of `WebhookEndpointResource`

Errors

Status	When it happens
`403`	The presenting API key does not carry the webhook.read scope

Example response, generated from the schema:

json

{
  "data": [
    {
      "id": "01JQ0000000000000000000000",
      "object": "string",
      "name": "Support Line",
      "url": "https://example.com/hook",
      "description": "string",
      "events": {},
      "assistant_ids": {},
      "headers": {},
      "active": true,
      "status": "string",
      "consecutive_failures": 1,
      "max_attempts": 1,
      "timeout_seconds": 30,
      "api_version": "string",
      "secret_rotated_at": "2026-01-01T12:00:00+00:00",
      "secret_overlap_until": "string",
      "last_success_at": "2026-01-01T12:00:00+00:00",
      "last_failure_at": "2026-01-01T12:00:00+00:00",
      "disabled_reason": "string",
      "created_at": "2026-01-01T12:00:00+00:00",
      "updated_at": "2026-01-01T12:00:00+00:00"
    }
  ]
}

Create a webhook endpoint and return its signing secret, the only time the secret is ever shown

POST/webhooks

The response is the only time the signing secret is returned. Store it immediately; afterwards it can be rotated but never read back.

Requires webhook.write.
secret and secret_notice sit beside data, not inside it. A URL resolving to a private address is rejected as a 422 on the url field.

Request body

Field	Type	Required	Notes
`name`	string	yes	max 255 chars
`url`	string	yes	uri. max 2048 chars
`description`	string \| null	—	max 500 chars
`events`	string[] \| null	—
`headers`	string[] \| null	—
`assistant_ids`	string[] \| null	—
`max_attempts`	integer \| null	—	min 1. max 12
`timeout_seconds`	integer \| null	—	min 1. max 60
`metadata`	string[] \| null	—
`active`	boolean \| null	—

cURLJavaScriptPHPPython

bash

curl -X POST "$CALLAGENT_API_URL/webhooks" \
  -H "Authorization: Bearer $CALLAGENT_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{
       "name": "Support Line",
       "url": "https://example.com/hook",
       "max_attempts": 1,
       "timeout_seconds": 30,
       "active": true
     }'

const response = await fetch(`${process.env.CALLAGENT_API_URL}/webhooks`, {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.CALLAGENT_API_KEY}`,
    Accept: 'application/json',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "name": "Support Line",
    "url": "https://example.com/hook",
    "max_attempts": 1,
    "timeout_seconds": 30,
    "active": true
  }),
});

if (!response.ok) {
  const { error } = await response.json();
  throw new Error(`${error.type}: ${error.message}`);
}

const { data } = await response.json();

php

<?php

$handle = curl_init(getenv('CALLAGENT_API_URL') . '/webhooks');

curl_setopt_array($handle, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('CALLAGENT_API_KEY'),
        'Accept: application/json',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
    'name' => 'Support Line',
    'url' => 'https://example.com/hook',
    'max_attempts' => 1,
    'timeout_seconds' => 30,
    'active' => true,
]),
]);

$body = json_decode(curl_exec($handle), true);
$status = curl_getinfo($handle, CURLINFO_HTTP_CODE);
curl_close($handle);

if ($status >= 400) {
    throw new RuntimeException("{$body['error']['type']}: {$body['error']['message']}");
}

$data = $body['data'];

python

import os, requests

response = requests.post(
    f"{os.environ['CALLAGENT_API_URL']}/webhooks",
    headers={"Authorization": f"Bearer {os.environ['CALLAGENT_API_KEY']}"},
    json={
      "name": "Support Line",
      "url": "https://example.com/hook",
      "max_attempts": 1,
      "timeout_seconds": 30,
      "active": True
    },
    timeout=30,
)
response.raise_for_status()
data = response.json()["data"]

Responses

Status	Body
`201`	`data`-wrapped object

Errors

Status	When it happens
`403`	The presenting API key does not carry the webhook.write scope
`422`	Validation failed, an event name is unknown, or the URL is SSRF-blocked

Example response, generated from the schema:

json

{
  "data": {
    "id": "01JQ0000000000000000000000",
    "object": "string",
    "name": "Support Line",
    "url": "https://example.com/hook",
    "description": "string",
    "events": {},
    "assistant_ids": {},
    "headers": {},
    "active": true,
    "status": "string",
    "consecutive_failures": 1,
    "max_attempts": 1,
    "timeout_seconds": 30,
    "api_version": "string",
    "secret_rotated_at": "2026-01-01T12:00:00+00:00",
    "secret_overlap_until": "string",
    "last_success_at": "2026-01-01T12:00:00+00:00",
    "last_failure_at": "2026-01-01T12:00:00+00:00",
    "disabled_reason": "string",
    "created_at": "2026-01-01T12:00:00+00:00",
    "updated_at": "2026-01-01T12:00:00+00:00"
  },
  "secret": "string",
  "secret_notice": "string"
}

Retrieve one webhook endpoint; the signing secret is structurally absent from the payload

GET/webhooks/{webhook}

Requires webhook.read.

Path parameters

Name	Type	Required	Notes
`webhook`	string	yes	The webhook ID

cURLJavaScriptPHPPython

bash

curl -X GET "$CALLAGENT_API_URL/webhooks/01JQ0000000000000000000000" \
  -H "Authorization: Bearer $CALLAGENT_API_KEY" \
  -H "Accept: application/json"

const response = await fetch(`${process.env.CALLAGENT_API_URL}/webhooks/01JQ0000000000000000000000`, {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${process.env.CALLAGENT_API_KEY}`,
    Accept: 'application/json',
  },
});

if (!response.ok) {
  const { error } = await response.json();
  throw new Error(`${error.type}: ${error.message}`);
}

const { data } = await response.json();

php

<?php

$handle = curl_init(getenv('CALLAGENT_API_URL') . '/webhooks/01JQ0000000000000000000000');

curl_setopt_array($handle, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('CALLAGENT_API_KEY'),
        'Accept: application/json',
    ],
]);

$body = json_decode(curl_exec($handle), true);
$status = curl_getinfo($handle, CURLINFO_HTTP_CODE);
curl_close($handle);

if ($status >= 400) {
    throw new RuntimeException("{$body['error']['type']}: {$body['error']['message']}");
}

$data = $body['data'];

python

import os, requests

response = requests.get(
    f"{os.environ['CALLAGENT_API_URL']}/webhooks/01JQ0000000000000000000000",
    headers={"Authorization": f"Bearer {os.environ['CALLAGENT_API_KEY']}"},
    timeout=30,
)
response.raise_for_status()
data = response.json()["data"]

Responses

Status	Body
`200`	`WebhookEndpointResource`

Errors

Status	When it happens
`403`	The presenting API key does not carry the webhook.read scope
`404`	No such endpoint in this organization

Example response, generated from the schema:

json

{
  "data": {
    "id": "01JQ0000000000000000000000",
    "object": "string",
    "name": "Support Line",
    "url": "https://example.com/hook",
    "description": "string",
    "events": {},
    "assistant_ids": {},
    "headers": {},
    "active": true,
    "status": "string",
    "consecutive_failures": 1,
    "max_attempts": 1,
    "timeout_seconds": 30,
    "api_version": "string",
    "secret_rotated_at": "2026-01-01T12:00:00+00:00",
    "secret_overlap_until": "string",
    "last_success_at": "2026-01-01T12:00:00+00:00",
    "last_failure_at": "2026-01-01T12:00:00+00:00",
    "disabled_reason": "string",
    "created_at": "2026-01-01T12:00:00+00:00",
    "updated_at": "2026-01-01T12:00:00+00:00"
  }
}

Update a webhook endpoint. The signing secret is not settable here

PUT/webhooks/{webhook}

Requires webhook.write.
PATCH is accepted on the same path, with the same body.
secret, previous_secret and organization_id are silently dropped. headers is read back as a list of header names only, never their values.

Path parameters

Name	Type	Required	Notes
`webhook`	string	yes	The webhook ID

Request body

Field	Type	Required	Notes
`name`	string	—	max 255 chars
`url`	string	—	uri. max 2048 chars
`description`	string \| null	—	max 500 chars
`events`	string[]	—
`headers`	string[] \| null	—
`assistant_ids`	string[]	—
`max_attempts`	integer	—	min 1. max 12
`timeout_seconds`	integer	—	min 1. max 60
`metadata`	string[] \| null	—
`active`	boolean	—

cURLJavaScriptPHPPython

bash

curl -X PUT "$CALLAGENT_API_URL/webhooks/01JQ0000000000000000000000" \
  -H "Authorization: Bearer $CALLAGENT_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{
       "name": "Support Line",
       "url": "https://example.com/hook",
       "max_attempts": 1,
       "timeout_seconds": 30,
       "active": true
     }'

const response = await fetch(`${process.env.CALLAGENT_API_URL}/webhooks/01JQ0000000000000000000000`, {
  method: 'PUT',
  headers: {
    Authorization: `Bearer ${process.env.CALLAGENT_API_KEY}`,
    Accept: 'application/json',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "name": "Support Line",
    "url": "https://example.com/hook",
    "max_attempts": 1,
    "timeout_seconds": 30,
    "active": true
  }),
});

if (!response.ok) {
  const { error } = await response.json();
  throw new Error(`${error.type}: ${error.message}`);
}

const { data } = await response.json();

php

<?php

$handle = curl_init(getenv('CALLAGENT_API_URL') . '/webhooks/01JQ0000000000000000000000');

curl_setopt_array($handle, [
    CURLOPT_CUSTOMREQUEST => 'PUT',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('CALLAGENT_API_KEY'),
        'Accept: application/json',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
    'name' => 'Support Line',
    'url' => 'https://example.com/hook',
    'max_attempts' => 1,
    'timeout_seconds' => 30,
    'active' => true,
]),
]);

$body = json_decode(curl_exec($handle), true);
$status = curl_getinfo($handle, CURLINFO_HTTP_CODE);
curl_close($handle);

if ($status >= 400) {
    throw new RuntimeException("{$body['error']['type']}: {$body['error']['message']}");
}

$data = $body['data'];

python

import os, requests

response = requests.put(
    f"{os.environ['CALLAGENT_API_URL']}/webhooks/01JQ0000000000000000000000",
    headers={"Authorization": f"Bearer {os.environ['CALLAGENT_API_KEY']}"},
    json={
      "name": "Support Line",
      "url": "https://example.com/hook",
      "max_attempts": 1,
      "timeout_seconds": 30,
      "active": True
    },
    timeout=30,
)
response.raise_for_status()
data = response.json()["data"]

Responses

Status	Body
`200`	`WebhookEndpointResource`

Errors

Status	When it happens
`403`	The presenting API key does not carry the webhook.write scope
`404`	No such endpoint in this organization
`422`	Validation failed, an event name is unknown, or a new URL is SSRF-blocked

Example response, generated from the schema:

json

{
  "data": {
    "id": "01JQ0000000000000000000000",
    "object": "string",
    "name": "Support Line",
    "url": "https://example.com/hook",
    "description": "string",
    "events": {},
    "assistant_ids": {},
    "headers": {},
    "active": true,
    "status": "string",
    "consecutive_failures": 1,
    "max_attempts": 1,
    "timeout_seconds": 30,
    "api_version": "string",
    "secret_rotated_at": "2026-01-01T12:00:00+00:00",
    "secret_overlap_until": "string",
    "last_success_at": "2026-01-01T12:00:00+00:00",
    "last_failure_at": "2026-01-01T12:00:00+00:00",
    "disabled_reason": "string",
    "created_at": "2026-01-01T12:00:00+00:00",
    "updated_at": "2026-01-01T12:00:00+00:00"
  }
}

Soft-delete a webhook endpoint and return an empty body

DELETE/webhooks/{webhook}

Requires webhook.write.
This response is not data-wrapped.
Delete is a soft delete and the dispatcher resolves endpoints withTrashed, so already-queued deliveries are still POSTed to a deleted endpoint.

Path parameters

Name	Type	Required	Notes
`webhook`	string	yes	The webhook ID

cURLJavaScriptPHPPython

bash

curl -X DELETE "$CALLAGENT_API_URL/webhooks/01JQ0000000000000000000000" \
  -H "Authorization: Bearer $CALLAGENT_API_KEY" \
  -H "Accept: application/json"

const response = await fetch(`${process.env.CALLAGENT_API_URL}/webhooks/01JQ0000000000000000000000`, {
  method: 'DELETE',
  headers: {
    Authorization: `Bearer ${process.env.CALLAGENT_API_KEY}`,
    Accept: 'application/json',
  },
});

if (!response.ok) {
  const { error } = await response.json();
  throw new Error(`${error.type}: ${error.message}`);
}

const { data } = await response.json();

php

<?php

$handle = curl_init(getenv('CALLAGENT_API_URL') . '/webhooks/01JQ0000000000000000000000');

curl_setopt_array($handle, [
    CURLOPT_CUSTOMREQUEST => 'DELETE',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('CALLAGENT_API_KEY'),
        'Accept: application/json',
    ],
]);

$body = json_decode(curl_exec($handle), true);
$status = curl_getinfo($handle, CURLINFO_HTTP_CODE);
curl_close($handle);

if ($status >= 400) {
    throw new RuntimeException("{$body['error']['type']}: {$body['error']['message']}");
}

$data = $body['data'];

python

import os, requests

response = requests.delete(
    f"{os.environ['CALLAGENT_API_URL']}/webhooks/01JQ0000000000000000000000",
    headers={"Authorization": f"Bearer {os.environ['CALLAGENT_API_KEY']}"},
    timeout=30,
)
response.raise_for_status()
data = response.json()["data"]

Responses

Status	Body
`204`	No content

Errors

Status	When it happens
`403`	The presenting API key does not carry the webhook.write scope
`404`	No such endpoint in this organization

Rotate the signing secret and return the new one; the previous secret keeps signing for an overlap

POST/webhooks/{webhook}/rotate-secret

The previous secret keeps signing alongside the new one for overlap_hours, so a rolling deploy of your verifier does not drop events. Pass 0 to revoke the old secret immediately.

Requires webhook.write.
secret sits beside data. overlap_hours defaults to 24; 0 retires the previous secret immediately.

Path parameters

Name	Type	Required	Notes
`webhook`	string	yes	The webhook ID

Request body

Field	Type	Required	Notes
`overlap_hours`	integer \| null	—	min 0. max 168

cURLJavaScriptPHPPython

bash

curl -X POST "$CALLAGENT_API_URL/webhooks/01JQ0000000000000000000000/rotate-secret" \
  -H "Authorization: Bearer $CALLAGENT_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{
       "overlap_hours": 1
     }'

const response = await fetch(`${process.env.CALLAGENT_API_URL}/webhooks/01JQ0000000000000000000000/rotate-secret`, {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.CALLAGENT_API_KEY}`,
    Accept: 'application/json',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "overlap_hours": 1
  }),
});

if (!response.ok) {
  const { error } = await response.json();
  throw new Error(`${error.type}: ${error.message}`);
}

const { data } = await response.json();

php

<?php

$handle = curl_init(getenv('CALLAGENT_API_URL') . '/webhooks/01JQ0000000000000000000000/rotate-secret');

curl_setopt_array($handle, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('CALLAGENT_API_KEY'),
        'Accept: application/json',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
    'overlap_hours' => 1,
]),
]);

$body = json_decode(curl_exec($handle), true);
$status = curl_getinfo($handle, CURLINFO_HTTP_CODE);
curl_close($handle);

if ($status >= 400) {
    throw new RuntimeException("{$body['error']['type']}: {$body['error']['message']}");
}

$data = $body['data'];

python

import os, requests

response = requests.post(
    f"{os.environ['CALLAGENT_API_URL']}/webhooks/01JQ0000000000000000000000/rotate-secret",
    headers={"Authorization": f"Bearer {os.environ['CALLAGENT_API_KEY']}"},
    json={
      "overlap_hours": 1
    },
    timeout=30,
)
response.raise_for_status()
data = response.json()["data"]

Responses

Status	Body
`200`	`data`-wrapped object

Errors

Status	When it happens
`403`	The presenting API key does not carry the webhook.write scope
`404`	No such endpoint in this organization
`422`	overlap_hours is not an integer in 0..168

Example response, generated from the schema:

json

{
  "data": {
    "id": "01JQ0000000000000000000000",
    "object": "string",
    "name": "Support Line",
    "url": "https://example.com/hook",
    "description": "string",
    "events": {},
    "assistant_ids": {},
    "headers": {},
    "active": true,
    "status": "string",
    "consecutive_failures": 1,
    "max_attempts": 1,
    "timeout_seconds": 30,
    "api_version": "string",
    "secret_rotated_at": "2026-01-01T12:00:00+00:00",
    "secret_overlap_until": "string",
    "last_success_at": "2026-01-01T12:00:00+00:00",
    "last_failure_at": "2026-01-01T12:00:00+00:00",
    "disabled_reason": "string",
    "created_at": "2026-01-01T12:00:00+00:00",
    "updated_at": "2026-01-01T12:00:00+00:00"
  },
  "secret": "string",
  "secret_notice": "string"
}

Queue a real signed test event so you can verify your signature check end to end

POST/webhooks/{webhook}/test

Requires webhook.write.
Returns the webhook_delivery, not the endpoint. The event is sent as event_type assistant.request with a payload containing test:true.

Path parameters

Name	Type	Required	Notes
`webhook`	string	yes	The webhook ID

cURLJavaScriptPHPPython

bash

curl -X POST "$CALLAGENT_API_URL/webhooks/01JQ0000000000000000000000/test" \
  -H "Authorization: Bearer $CALLAGENT_API_KEY" \
  -H "Accept: application/json"

const response = await fetch(`${process.env.CALLAGENT_API_URL}/webhooks/01JQ0000000000000000000000/test`, {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.CALLAGENT_API_KEY}`,
    Accept: 'application/json',
  },
});

if (!response.ok) {
  const { error } = await response.json();
  throw new Error(`${error.type}: ${error.message}`);
}

const { data } = await response.json();

php

<?php

$handle = curl_init(getenv('CALLAGENT_API_URL') . '/webhooks/01JQ0000000000000000000000/test');

curl_setopt_array($handle, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('CALLAGENT_API_KEY'),
        'Accept: application/json',
    ],
]);

$body = json_decode(curl_exec($handle), true);
$status = curl_getinfo($handle, CURLINFO_HTTP_CODE);
curl_close($handle);

if ($status >= 400) {
    throw new RuntimeException("{$body['error']['type']}: {$body['error']['message']}");
}

$data = $body['data'];

python

import os, requests

response = requests.post(
    f"{os.environ['CALLAGENT_API_URL']}/webhooks/01JQ0000000000000000000000/test",
    headers={"Authorization": f"Bearer {os.environ['CALLAGENT_API_KEY']}"},
    timeout=30,
)
response.raise_for_status()
data = response.json()["data"]

Responses

Status	Body
`202`	`data`-wrapped object

Errors

Status	When it happens
`403`	The presenting API key does not carry the webhook.write scope
`404`	No such endpoint in this organization

Example response, generated from the schema:

json

{
  "data": {
    "id": "01JQ0000000000000000000000",
    "object": "string",
    "webhook_endpoint_id": "01JQ0000000000000000000000",
    "event_id": "01JQ0000000000000000000000",
    "event_type": "string",
    "status": "string",
    "attempts": 1,
    "max_attempts": 1,
    "response_status": 1,
    "duration_ms": 30,
    "error": "string",
    "call_id": "01JQ0000000000000000000000",
    "assistant_id": "01JQ0000000000000000000000",
    "next_attempt_at": "2026-01-01T12:00:00+00:00",
    "delivered_at": "2026-01-01T12:00:00+00:00",
    "failed_at": "2026-01-01T12:00:00+00:00",
    "redelivery_of_id": "01JQ0000000000000000000000",
    "created_at": "2026-01-01T12:00:00+00:00",
    "payload": {},
    "request_headers": {},
    "response_headers": {},
    "response_body": "string",
    "attempt_log": [
      {}
    ]
  }
}

List the webhook event types an endpoint can subscribe to, each with its label, group and volume flag

GET/webhooks/events

No scope is enforced in the handler — any valid key may call it.
The response is a flat list carrying a group field per entry, not a grouped object.

cURLJavaScriptPHPPython

bash

curl -X GET "$CALLAGENT_API_URL/webhooks/events" \
  -H "Authorization: Bearer $CALLAGENT_API_KEY" \
  -H "Accept: application/json"

const response = await fetch(`${process.env.CALLAGENT_API_URL}/webhooks/events`, {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${process.env.CALLAGENT_API_KEY}`,
    Accept: 'application/json',
  },
});

if (!response.ok) {
  const { error } = await response.json();
  throw new Error(`${error.type}: ${error.message}`);
}

const { data } = await response.json();

php

<?php

$handle = curl_init(getenv('CALLAGENT_API_URL') . '/webhooks/events');

curl_setopt_array($handle, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('CALLAGENT_API_KEY'),
        'Accept: application/json',
    ],
]);

$body = json_decode(curl_exec($handle), true);
$status = curl_getinfo($handle, CURLINFO_HTTP_CODE);
curl_close($handle);

if ($status >= 400) {
    throw new RuntimeException("{$body['error']['type']}: {$body['error']['message']}");
}

$data = $body['data'];

python

import os, requests

response = requests.get(
    f"{os.environ['CALLAGENT_API_URL']}/webhooks/events",
    headers={"Authorization": f"Bearer {os.environ['CALLAGENT_API_KEY']}"},
    timeout=30,
)
response.raise_for_status()
data = response.json()["data"]

Responses

Status	Body
`200`	`data`-wrapped array

Example response, generated from the schema:

json

{
  "data": [
    {
      "value": "string",
      "label": "string",
      "group": "Assistant",
      "high_volume": true
    }
  ]
}

Webhook endpoints ​

Endpoints ​

List webhook endpoints newest first, filterable by active state and by subscribed event ​

Create a webhook endpoint and return its signing secret, the only time the secret is ever shown ​

Retrieve one webhook endpoint; the signing secret is structurally absent from the payload ​

Update a webhook endpoint. The signing secret is not settable here ​

Soft-delete a webhook endpoint and return an empty body ​

Rotate the signing secret and return the new one; the previous secret keeps signing for an overlap ​

Queue a real signed test event so you can verify your signature check end to end ​

List the webhook event types an endpoint can subscribe to, each with its label, group and volume flag ​

Webhook endpoints

Endpoints

List webhook endpoints newest first, filterable by active state and by subscribed event

Create a webhook endpoint and return its signing secret, the only time the secret is ever shown

Retrieve one webhook endpoint; the signing secret is structurally absent from the payload

Update a webhook endpoint. The signing secret is not settable here

Soft-delete a webhook endpoint and return an empty body

Rotate the signing secret and return the new one; the previous secret keeps signing for an overlap

Queue a real signed test event so you can verify your signature check end to end

List the webhook event types an endpoint can subscribe to, each with its label, group and volume flag