API Reference
Webhooks
Receiving events, and verifying they genuinely came from us.
Webhooks push events to a URL you control, so you do not have to poll.
Registering
curl -X POST https://www.siluxcall.co.uk/api/webhooks \
-H "Authorization: Bearer sk_live_..." \
-H "Content-Type: application/json" \
-d '{
"url": "https://example.com/hooks/silux",
"events": ["call.completed", "voicemail.received"],
"headers": {"X-My-Auth": "optional-extra-header"}
}'Managing subscriptions
| Action | Endpoint |
|---|---|
| List | GET /api/webhooks |
| Register | POST /api/webhooks |
| Update | PATCH /api/webhooks/:id |
| Delete | DELETE /api/webhooks/:id |
Headers on every delivery
| Header | Meaning |
|---|---|
| X-Webhook-Signature | HMAC-SHA256 of the payload, using your subscription secret |
| X-Webhook-Event | The event type |
| X-Webhook-Timestamp | When we sent it |
Verifying the signature
Always verify. An unverified webhook endpoint is a public API that anyone who guesses the URL can post to.
const crypto = require('crypto');
function verify(rawBody, signature, secret) {
const expected = crypto
.createHmac('sha256', secret)
.update(rawBody)
.digest('hex');
// Constant-time compare — a plain === leaks the signature byte by byte.
return crypto.timingSafeEqual(
Buffer.from(signature),
Buffer.from(expected),
);
}Verify against the RAW request body. If your framework parses and re-serialises the JSON first, the bytes change and the signature will never match.
Failures and retries
Return a 2xx quickly. Deliveries are recorded and a failed one can be retried from the dashboard. Do your slow work after acknowledging, not before — a slow endpoint looks like a failed one.