Webhooks and events

curl https://api.liveleg.dev/v1/webhook_endpoints \
  -H "Authorization: Bearer $LIVELEG_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://app.example.com/hooks/liveleg",
    "events": [
      "call.bridged",
      "call.completed",
      "amd.completed",
      "summary.ready"
    ]
  }'

const res = await fetch('https://api.liveleg.dev/v1/webhook_endpoints', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.LIVELEG_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    url: 'https://app.example.com/hooks/liveleg',
    events: [
      'call.bridged',
      'call.completed',
      'amd.completed',
      'summary.ready',
    ],
  }),
});
const endpoint = await res.json();

import os, requests

endpoint = requests.post(
    "https://api.liveleg.dev/v1/webhook_endpoints",
    headers={"Authorization": f"Bearer {os.environ['LIVELEG_API_KEY']}"},
    json={
        "url": "https://app.example.com/hooks/liveleg",
        "events": [
            "call.bridged",
            "call.completed",
            "amd.completed",
            "summary.ready",
        ],
    },
).json()

{
  "id": "whe_7Kc02",
  "url": "https://app.example.com/hooks/liveleg",
  "events": [
    "call.bridged",
    "call.completed",
    "amd.completed",
    "summary.ready"
  ],
  "secret": "whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw",
  "status": "enabled"
}

{
  "id": "evt_2Wc81Lk0",
  "type": "call.bridged",
  "created_at": "2026-11-03T15:42:07.412Z",
  "livemode": true,
  "account_id": "acc_ridgeline",
  "data": {
    "call_id": "cal_8Jq2mT4x",
    "dial_session_id": "dls_31Ka9",
    "agent_id": "agt_114",
    "speech_ended_to_bridge_ms": 980,
    "legs_canceled": 2
  }
}

POST /hooks/liveleg HTTP/1.1
Content-Type: application/json
webhook-id: msg_2Wc81Lk0
webhook-timestamp: 1793720527
webhook-signature: v1,K5oZfzN95Z9UVu1EsfQmfVNQhnkZ2pj9o9NDN/H/pI4=

import crypto from 'node:crypto';
import express from 'express';

const app = express();
// whsec_... from the endpoint. The part after the prefix is base64.
const secret = Buffer.from(process.env.LIVELEG_WEBHOOK_SECRET.split('_')[1], 'base64');

app.post('/hooks/liveleg', express.raw({ type: 'application/json' }), (req, res) => {
  const id = req.header('webhook-id');
  const timestamp = req.header('webhook-timestamp');
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return res.sendStatus(400);

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${id}.${timestamp}.${req.body}`)
    .digest('base64');
  const valid = req.header('webhook-signature').split(' ').some((s) => {
    const sig = Buffer.from(s.split(',')[1] ?? '');
    return sig.length === expected.length && crypto.timingSafeEqual(sig, Buffer.from(expected));
  });
  if (!valid) return res.sendStatus(400);

  const event = JSON.parse(req.body);
  queue.add(event.type, event, { jobId: id }); // webhook-id is the same on every retry
  res.sendStatus(204);
});

import base64, hashlib, hmac, os, time
from flask import Flask, request

app = Flask(__name__)
# whsec_... from the endpoint. The part after the prefix is base64.
secret = base64.b64decode(os.environ["LIVELEG_WEBHOOK_SECRET"].split("_", 1)[1])

@app.post("/hooks/liveleg")
def liveleg_hook():
    msg_id = request.headers["webhook-id"]
    timestamp = request.headers["webhook-timestamp"]
    if abs(time.time() - int(timestamp)) > 300:
        return "", 400

    signed = f"{msg_id}.{timestamp}.{request.get_data(as_text=True)}".encode()
    expected = base64.b64encode(hmac.new(secret, signed, hashlib.sha256).digest()).decode()
    sigs = [s.split(",", 1)[-1] for s in request.headers["webhook-signature"].split()]
    if not any(hmac.compare_digest(s, expected) for s in sigs):
        return "", 400

    enqueue(request.get_json(), dedupe_key=msg_id)  # same id on every retry
    return "", 204

curl -X POST https://api.liveleg.dev/v1/webhook_endpoints/whe_7Kc02/rotate_secret \
  -H "Authorization: Bearer $LIVELEG_API_KEY"

// webhook_events has a unique index on webhook_id.
async function handleDelivery(webhookId, event) {
  const { rowCount } = await db.query(
    'INSERT INTO webhook_events (webhook_id, type, created_at) VALUES ($1, $2, $3) ON CONFLICT DO NOTHING',
    [webhookId, event.type, event.created_at],
  );
  if (rowCount === 0) return; // already handled

  if (event.type === 'call.completed') {
    await crm.logCall(event.data.call_id, event.data.billed_seconds, event.data.disposition);
  }
}

# webhook_events has a unique index on webhook_id.
def handle_delivery(webhook_id, event):
    cur = db.execute(
        "INSERT INTO webhook_events (webhook_id, type, created_at) VALUES (%s, %s, %s) ON CONFLICT DO NOTHING",
        (webhook_id, event["type"], event["created_at"]),
    )
    if cur.rowcount == 0:
        return  # already handled

    if event["type"] == "call.completed":
        crm.log_call(event["data"]["call_id"], event["data"]["billed_seconds"], event["data"]["disposition"])

curl -X POST https://api.liveleg.dev/v1/events/evt_2Wc81Lk0/resend \
  -H "Authorization: Bearer $LIVELEG_API_KEY"