Skip to main content
Update a webhook

Authorizations

Authorization
string
header
required

Every request sends Authorization: Bearer <token>. The token is either a panel session (a JWT from /auth/login, 12 hours) or an API key ft_<id>_<secret>. An API key is accepted only from an address on its IP allowlist (403 ip_not_allowed otherwise; 403 ip_allowlist_required for an old key that has none), is limited to its rate per minute (429 rate_limited with Retry-After; X-RateLimit-Limit/Remaining/Reset on every response), and at most 60 call placements a minute.

Path Parameters

id
string<uuid>
required

Body

application/json
enabled
boolean
events
enum<string>[]
Available options:
call.started,
call.ringing,
call.answered,
call.ended,
call.missed,
voicemail.received,
recording.ready,
conversation.completed,
callback.requested,
ticket.created,
ticket.updated,
contact.created,
campaign.contact.completed,
campaign.completed,
csat.submitted
headers
object

Merged: a value sets, null removes, unmentioned headers keep their value.

name
string
rotate_secret
boolean

Make a new secret, returned once; the old one stops working at once.

url
string

Response

OK

Call events posted to your URL. Every request carries X-FireTone-Signature: t=,v1=<hex HMAC-SHA256(secret, "t.body")>, X-FireTone-Event and X-FireTone-Delivery. Header values and the secret are never returned.

created_at
string<date-time>
disabled_reason
string | null

Why the webhook was switched off. Switching it back on clears it.

enabled
boolean
events
enum<string>[]
Available options:
call.started,
call.ringing,
call.answered,
call.ended,
call.missed,
voicemail.received,
recording.ready,
conversation.completed,
callback.requested,
ticket.created,
ticket.updated,
contact.created,
campaign.contact.completed,
campaign.completed,
csat.submitted
failing_since
string<date-time> | null

Deliveries have failed without a success since then; three days of it switches the webhook off.

header_names
string[]
id
string<uuid>
name
string
organisation_id
string<uuid>
secret
string

The signing secret. Only on the create and rotate responses: shown once.

updated_at
string<date-time>
url
string