IVR HTTP Request Node: Call Your API From a Live Call

The HTTP Request node lets an IVR call your API in the middle of a call. In async mode it fires in the background with retries and the call carries on. In sync mode the caller waits up to 5 seconds and the flow branches on Success or Failure. Every request is HTTPS, filled with call tokens, and HMAC-signed.

Wire your API into a call flow: Try Edesy IVR Studio — Rs 20 free credit on sign-up, no card needed.

What you can do with it

• Confirm or cancel an order when the caller presses 1 or 2.
• Record a survey rating and a spoken reason in your database.
• Check whether you're open, and branch to a team or to voicemail.
• Check whether a caller's number is a known customer, and branch to a priority line.
• Create a ticket or a lead in your CRM from a menu choice.

Node settings

Tokens you can use

Sync or async?

Use async when the caller doesn't need to wait for the answer: logging a rating, notifying your CRM, recording a lead. It's resilient: if your API is briefly down, the request is retried after the call moves on.

Use sync when the next step depends on your system: "is this order still cancellable?", "are we open?". Keep sync endpoints fast. The caller hears silence while waiting, so budget well under the 5-second cap, and always connect the Failure branch to something sensible, such as "Sorry, we couldn't do that right now. Connecting you to our team."

Example: confirm an order on keypress

Flow (the "Order confirmation (API + HTTP)" template):

1. Your app places the call: POST /v1/ivr/calls with the flow ID and variables such as order_id and customer_name, plus an idempotency key.
2. Say: "Hello {{var.customer_name}}, about your order {{var.order_id}}..."
3. Menu: 1 to confirm, 2 to cancel.
4. HTTP Request (sync, POST) on branch 1:

URL:  https://api.example.com/orders/{{var.order_id}}/confirm
Body: {
  "order_id": "{{var.order_id}}",
  "digit": "{{digits}}",
  "caller": "{{caller}}",
  "call_sid": "{{call_sid}}"
}

5. Success: "Thank you, your order is confirmed." Failure: transfer to your team.

Your endpoint should be idempotent: treat a repeat with the same call_sid as a no-op, because async retries and a caller pressing twice can both send the same request.

Example: are we open?

Put a sync GET first in the flow:

GET https://api.example.com/ivr/open?did={{did}}

Return 200 when you're open and 503 when you're closed. Success goes to your menu; Failure goes to an after-hours message and voicemail. IVR Studio has no built-in business-hours switch, so this keeps the schedule (and holidays) in your own system. See voicemail for after-hours calls.

Verifying the signature

Every request carries two headers:

• X-Edesy-Timestamp: Unix seconds.
• X-Edesy-Signature: sha256= + hex(HMAC-SHA256(secret, timestamp + "." + raw_body)).

Your signing secret is in the IVR portal and can be rotated. In Node.js:

import crypto from "node:crypto";
 
function verify(req, rawBody, secret) {
  const ts = req.headers["x-edesy-timestamp"];
  const sig = req.headers["x-edesy-signature"] || "";
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
  const expected = "sha256=" +
    crypto.createHmac("sha256", secret).update(`${ts}.${rawBody}`).digest("hex");
  return sig.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
}

Hash the raw body bytes, not re-serialised JSON, and reject timestamps older than a few minutes.

Debugging

• HTTP logs in the portal show each request, response code, a truncated response body, duration and retries. The same data is available from /v1/ivr/http-logs.
• Test before publishing with the HTTP test endpoint (/v1/ivr/http-test) or a test call from the builder.
• Live validation warns when a sync node has no Success or Failure branch connected (the call would hang up there) and blocks branches on an async node.

Common mistakes

• Putting a token in the host name (not allowed; keep the host fixed).
• Sync calls to slow endpoints, leaving callers in silence.
• No Failure branch, or a Failure branch that hangs up without explanation.
• Non-idempotent handlers that confirm the same order twice.
• Verifying the signature against parsed-and-re-stringified JSON.

Cost

You pay for call minutes: IVR Studio is Rs 1.50/min plus number rental, excluding 18% GST. More detail in the outbound IVR API guide, on the HTTP Request node page and in the IVR docs.

Build a flow that calls your API with Rs 20 free credit, no card needed.