Webhooks

Webhooks push Veytrix events to your URL in real time. Use them to update an ATS, notify a team channel, start an automation, or store completed call and rating results in another system.

Webhooks are managed under Developer → Webhooks. The instant a call finishes or a rating is ready, Veytrix sends an HTTP POST with a JSON body to the endpoint you register.

How it works

Events

Register an endpoint

1. Go to Developer → Webhooks.
2. Paste your receiving URL (your server, or a Zapier / Make "catch hook" URL).
3. Tick the events you want, then Add webhook. A signing secret (whsec_…) is generated for you.

Payload

Every delivery is a JSON body shaped like this:

POST  (your endpoint)
Content-Type: application/json
X-Veytrix-Event: call.completed
X-Veytrix-Signature: sha256=9f0b…   ← HMAC of the body

{
  "event": "call.completed",
  "organizationId": "org_…",
  "data": {
    "callId": "b872001f-41d2-4a1a-9b14-f63c80b050a5",
    "status": "completed",
    "durationSeconds": 75,
    "targetName": "Asha Rao",
    "targetPhone": "+919876543210",
    "summaryText": "Candidate confirmed availability…"
  },
  "sentAt": "2026-06-02T11:21:25.000Z"
}

For rating.created, data contains callId, candidateName, overallRating and agentName.

Verify the signature

Each request carries X-Veytrix-Signature: sha256=<hex> — an HMAC-SHA256 of the raw request body keyed by your webhook's secret. Always verify it before trusting a payload, so nobody can forge events:

import crypto from "node:crypto";
import express from "express";

const SECRET = process.env.VEYTRIX_WEBHOOK_SECRET; // whsec_…
const app = express();

app.post("/veytrix-webhook",
  express.raw({ type: "application/json" }),   // need the RAW body
  (req, res) => {
    const sig = req.header("X-Veytrix-Signature") || "";
    const expected =
      "sha256=" + crypto.createHmac("sha256", SECRET).update(req.body).digest("hex");

    // constant-time compare
    const ok = sig.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
    if (!ok) return res.status(401).end();

    const event = JSON.parse(req.body.toString());
    // handle event.event / event.data …
    res.sendStatus(200);
  });

Behavior & best practices

• Respond with 2xx quickly. Do heavy work asynchronously after acknowledging.
• Deliveries are fire-and-forget with a 10-second timeout; a broken endpoint never blocks your calls.
• Make your handler idempotent — dedupe on data.callId in case of a repeat.
• Toggle a webhook off (instead of deleting) to pause deliveries; the secret is retained.