Webhooks

A webhook endpoint receives an HTTPS POST for every event it subscribes to. Create endpoints with POST /v1/webhook-endpoints.

Verifying a delivery

Deliveries are signed according to the Standard Webhooks specification, so its libraries verify them for you.

Header	Contents
webhook-id	The event’s unique id. Use it to deduplicate
webhook-timestamp	Unix time of this delivery attempt
webhook-signature	v1,<base64 HMAC-SHA256> over id.timestamp.body, with your endpoint’s secret

Check the signature over the raw body, before parsing it, and refuse a timestamp more than five minutes old.

Delivery

• Answer with a 2xx within 10 seconds. Do the work afterwards.
• Redirects aren’t followed.
• A failed delivery is retried with exponential backoff for up to 3 days. After 3 days of failures, the endpoint is turned off.
• Order isn’t guaranteed. Compare created_at, and fetch the record when you need its latest state.
• After you rotate the secret, the old and the new secret both sign for 24 hours.

Payloads

Conversation events contain only the conversation’s id, the event type and the names of the fields that changed. Caller names, numbers and messages stay out of your logs: fetch the conversation for its current state. Other events contain the whole record.

{
  "id": "evt_7Ss1",
  "type": "conversation.updated",
  "created_at": "2026-11-09T08:12:30Z",
  "data": { "id": "c_93kLm0", "changed": ["summary", "callback"] }
}

Event types

Resource	Events
Conversations	conversation.created, conversation.updated, conversation.summary_ready, conversation.archived, conversation.message.received, conversation.media.received
Rides	ride.created, ride.updated, ride.status_changed, ride.deleted
Assignments	assignment.created, assignment.updated, assignment.deleted
Contacts	contact.created, contact.updated, contact.deleted
Runaways	runaway.created, runaway.updated, runaway.deleted
Payments	payment.paid, payment.failed, payment.review_changed

Events are kept for 30 days, and GET /v1/events lists them.