Event Webhooks

​

Overview

​

Event Types

​

Configuration

• Name — a label for the configuration
• Endpoint URL — your HTTPS endpoint (max 2048 chars; https:// required)
• Events — which event types to subscribe to (at least one)
• Custom headers — optional name/value pairs sent on every delivery; individual headers can be marked encrypted (stored AES-GCM encrypted, never returned in plaintext)
• Include transcript / recording URL — opt-in flags controlling optional fields on voice_call.completed payloads
• Lead source filter — optionally restrict lead.* events to specific lead sources

​

Verifying Signatures

import crypto from 'node:crypto';

function verify(req, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(req.rawBody)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(req.headers['x-webhook-signature'] ?? '')
  );
}

​

Delivery & Retries

• Deliveries are POST requests with Content-Type: application/json and a 10-second timeout.
• Failed deliveries are retried 5 times with exponential backoff. 4xx responses are treated as non-retriable (a misconfigured endpoint won’t be hammered); 5xx and network errors are retried.
• Use X-Avoca-Event-Id for idempotency — it is stable across retries of the same event.
• Auto-pause: after 50 consecutive failures a configuration is automatically disabled (disabled_reason: auto_paused_consecutive_failures). Any successful (2xx) delivery resets the counter. Re-enable from the dashboard once your endpoint is healthy.
• Delivery logs are retained for 90 days.

​

Respond Quickly