API Reference
Webhooks
Receiving events, and verifying they genuinely came from us.
Webhooks push events to a URL you control, so you do not have to poll.
Registering
curl -X POST https://www.siluxcall.co.uk/api/webhooks \
-H "Authorization: Bearer sk_live_..." \
-H "Content-Type: application/json" \
-d '{
"url": "https://example.com/hooks/silux",
"events": ["call.ended", "voicemail.received"],
"headers": {"X-My-Auth": "optional-extra-header"}
}'Register with your API key from your server, or while signed in to the dashboard. The answer includes the subscription's secret, which signs every delivery. Keep it with your API key.
Call and voicemail events
| Event | Sent when | data |
|---|---|---|
| call.ended | Any call on your account finishes, answered or not | id, callId, direction, from, to, status (ANSWERED, NO_ANSWER, BUSY, FAILED, VOICEMAIL), durationSeconds, startedAt, answeredAt, endedAt |
| voicemail.received | A caller leaves a voicemail | voicemailId, from, to, durationSeconds, receivedAt |
id is stable: it is the same id the call has in GET /api/v1/calls, so you can match a delivery to your call history and ignore repeats.
Managing subscriptions
| Action | Endpoint |
|---|---|
| List | GET /api/webhooks |
| Register | POST /api/webhooks |
| Update | PATCH /api/webhooks/:id |
| Delete | DELETE /api/webhooks/:id |
Headers on every delivery
| Header | Meaning |
|---|---|
| X-Webhook-Signature | HMAC-SHA256 of the payload, using your subscription secret |
| X-Webhook-Event | The event type |
| X-Webhook-Timestamp | When we sent it |
Verifying the signature
Always verify. An unverified webhook endpoint is a public API that anyone who guesses the URL can post to.
const crypto = require('crypto');
function verify(rawBody, signature, secret) {
const expected = crypto
.createHmac('sha256', secret)
.update(rawBody)
.digest('hex');
// Constant-time compare — a plain === leaks the signature byte by byte.
return crypto.timingSafeEqual(
Buffer.from(signature),
Buffer.from(expected),
);
}Verify against the RAW request body. If your framework parses and re-serialises the JSON first, the bytes change and the signature will never match.
Failures and retries
Return a 2xx quickly. Deliveries are recorded and a failed one can be retried from the dashboard. Do your slow work after acknowledging, not before — a slow endpoint looks like a failed one.
Custom Webhook (CRM Integration page)
Without writing any code against the API, you can add a Custom Webhook on the CRM Integration page. Choose which events it gets: ended calls, missed calls and new voicemails. Each one is POSTed to your URL as JSON as it happens.
{
"type": "call_end",
"tenantId": "your account id",
"callId": "1793801744.25245",
"fromNumber": "+447700900123",
"toNumber": "02031371469",
"direction": "INBOUND",
"duration": 180,
"startTime": "2026-11-04T14:15:44.000Z"
}type is call_end, missed_call or voicemail. Every delivery carries X-Webhook-Event (the type) and X-Webhook-Timestamp. Enter a Signing secret on the integration and each delivery also carries X-Webhook-Signature: the HMAC-SHA256 (hex) of the raw body with that secret. Check it with the verify function above.
Use Test on the integration to send a sample call_end delivery to your URL.