Webhooks

Register an HTTPS endpoint and Aurtio posts you a signed JSON body on every event — so your systems react the moment a call ends or a lead lands.

Events

call.ended

id, agent_id, room, direction, duration_sec, cost_inr, turns

lead.captured

id, name, phone, requirement, call_room

booking.created

id, name, when_text, purpose, call_room

call.summary

id, summary, disposition, extracted { … }

Delivery body

Every delivery has the same envelope — the event name plus its data:

json

{
  "id": "<delivery id>",
  "event": "call.ended",
  "created_at": "…",
  "data": { … }
}

Verify the signature

Each request carries X-Aurtio-Signature: t=<unix>,v1=<hex>, where v1 = HMAC_SHA256(secret, "{t}.{raw_body}"). The signing secret (whsec_…) is shown once at registration. Reject the request if |now − t| > 300s.

verify.pypython

import hmac, hashlib, time

def verify(secret, body, header):
    p = dict(kv.split("=", 1) for kv in header.split(","))
    if abs(time.time() - int(p["t"])) > 300:
        return False
    mac = hmac.new(secret.encode(), f"{p['t']}.{body}".encode(),
                   hashlib.sha256).hexdigest()
    return hmac.compare_digest(mac, p["v1"])

Example payloads

jsonc

// call.ended
{"event":"call.ended","data":{"id":"<call>","agent_id":"<agent>","room":"call-…",
  "direction":"inbound","duration_sec":42,"cost_inr":1.4,"turns":6}}

// lead.captured
{"event":"lead.captured","data":{"id":"<lead>","name":"Ravi","phone":"98765…",
  "requirement":"dental appointment","call_room":"call-…"}}

// booking.created
{"event":"booking.created","data":{"id":"<booking>","name":"Ravi",
  "when_text":"kal shaam 5 baje","purpose":"consultation","call_room":"call-…"}}

// call.summary
{"event":"call.summary","data":{"id":"<call>","summary":"…","disposition":"lead",
  "extracted":{"name":"Ravi","phone":null,"appointment_time":"kal 5pm"}}}

Delivery & retries

Deliveries retry with exponential backoff (30s · 4ⁿ, up to 5 attempts). Endpoints must be public HTTPS — private and internal addresses are rejected.