Edesy Developer Hub: Voice, SIP, IVR and Messaging APIs

POST /v1/calls takes one of five instructions: text to speak, an answer URL returning VoiceML, inline VoiceML, a WebSocket stream_url, or an application ID.

# Your first call: speak a message to a phone
curl -X POST https://voice-api.edesy.in/v1/calls \
  -H "Authorization: Bearer $EDESY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "from": "+9180XXXXXXXX",
    "to":   "+9198XXXXXXXX",
    "url":  "https://myapp.example.com/answer",
    "status_callback": "https://myapp.example.com/call-status"
  }'

# Your answer URL returns VoiceML (JSON), not TwiML
{ "instructions": [ { "verb": "say", "text": "Hello from Edesy." }, { "verb": "hangup" } ] }

Voice API status callbacks and IVR requests sign the timestamp, a dot and the raw body. Only the header names and the prefix differ.

// Timestamped schemes: Voice API status_callback (v1=) and IVR (sha256=)
const crypto = require("crypto");

function verifyTimestamped(rawBody, ts, header, secret, prefix /* "v1=" or "sha256=" */) {
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;   // 5 minutes
  const expected = prefix + crypto.createHmac("sha256", secret)
    .update(`${ts}.`).update(rawBody).digest("hex");
  return header.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(header), Buffer.from(expected));
}

// Voice API:  verifyTimestamped(body, req.get("X-Webhook-Timestamp"), req.get("X-Webhook-Signature"), SECRET, "v1=")
// IVR:        verifyTimestamped(body, req.get("X-Edesy-Timestamp"),  req.get("X-Edesy-Signature"),  SECRET, "sha256=")

Subscription webhooks, masking and WhatsApp sign the raw body alone. If verification fails, the usual cause is hashing re-serialised JSON instead of the bytes received.

# Body-only scheme: subscriptions, masking, WhatsApp (X-Edesy-Signature: sha256=<hex>)
import hmac, hashlib

def verify_body(raw: bytes, header: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(secret.encode(), raw, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, header or "")

# Flask: verify_body(request.get_data(), request.headers.get("X-Edesy-Signature"), SECRET)