COD Confirmation Calls for Your Own Store or Backend

1. Send us the order

POST JSON to your webhook URL when a COD order is placed. Amounts are in paise.

{
  "event": "order.created",
  "event_id": "evt_7f3a9c",
  "order": {
    "id": "10452",
    "name": "#10452",
    "customer_name": "Priya Sharma",
    "phone": "+919800000000",
    "payment_method": "cod",
    "total_paise": 111000,
    "cod_amount_paise": 111000,
    "cod_confirmed": false,
    "items": [{ "title": "Cotton Kurta", "quantity": 1 }]
  }
}

• event is order.created, order.cancelled or order.paid.
• event_id is used to ignore duplicate deliveries, so retries from your side are safe.
• cod_amount_paise is the amount read out to the customer. Set it when only part of the order is cash on delivery; otherwise total_paise is used.
• Send order.cancelled for the same id if the order is cancelled before we call, and the call is skipped.

2. Sign the request

Add two headers. The signature is a hex HMAC-SHA256 of the timestamp, a dot, and the raw request body, using your signing secret. Requests older than 5 minutes are rejected.

X-Edesy-Timestamp: 1760256000
X-Edesy-Signature: sha256=<hex HMAC-SHA256(secret, timestamp + "." + raw_body)>

import crypto from "node:crypto";

const body = JSON.stringify(event);
const ts = Math.floor(Date.now() / 1000).toString();
const signature = "sha256=" + crypto
  .createHmac("sha256", process.env.EDESY_WEBHOOK_SECRET)
  .update(ts + "." + body)
  .digest("hex");

await fetch(process.env.EDESY_WEBHOOK_URL, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-Edesy-Timestamp": ts,
    "X-Edesy-Signature": signature,
  },
  body,
});

3. Receive the result

When the customer answers, we POST to your action URL:

{
  "action": "confirm",
  "order_id": "10452",
  "order_name": "#10452",
  "call_sid": "c4b1e2d0-...",
  "at": "2026-10-12T11:42:05+05:30"
}

• action is confirm or cancel. Depending on your rules you may also receive tag or note actions, for example to mark an order unreachable.
• The request is signed with the same scheme as above (X-Edesy-Timestamp and X-Edesy-Signature: sha256=...), but with your account's IVR signing secret, which is separate from the store webhook secret. You get both during setup. Verify the signature before updating the order.
• It also carries X-Edesy-Call-Sid (the call) and X-Edesy-Idempotency-Key; use the idempotency key to ignore a result you have already applied.
• Make your handler safe to run twice for the same order: if your endpoint times out or returns a 5xx, we retry.
• No action URL? Leave it empty and use the order outcomes in your dashboard instead.