Missed Call API and Webhook

Base URL https://voice-api.edesy.in/v1. Authenticate with a Bearer API key created in the portal. Full request and response details, plus curl, Node, Python and PHP samples, are in the docs.

# Base URL: https://voice-api.edesy.in/v1   Auth: Bearer API key from the portal
curl -H "Authorization: Bearer $EDESY_API_KEY" \
  https://voice-api.edesy.in/v1/missed-calls

GET  /missed-calls                     list missed calls
GET  /missed-calls/summary             totals, unique callers, per-day counts
GET  /missed-calls/export.csv          CSV export
GET  /missed-calls/pricing             current plan prices
GET  /missed-calls/numbers             your missed call numbers
POST /missed-calls/numbers/:id/enable  switch missed-call routing on for a number
     (plus plan endpoints for Pay as you go / Unlimited)
GET  /webhooks/subscriptions           manage call.missed webhook subscriptions

Add a webhook URL in the portal (or via /webhooks/subscriptions) and every missed call is POSTed as JSON. Use the test button to send a sample event before going live.

{
  "event": "call.missed",
  "timestamp": "2026-10-20T10:42:13Z",
  "data": {
    "call_sid": "3f6c2a1e-8b4d-4c1a-9e2f-7d5b0a9c1e44",
    "from": "+919876543210",
    "to": "+918045678901",
    "direction": "inbound",
    "status": "missed",
    "phone_number_id": "b21d7e90-5c3a-4f8e-a6d2-91c4e0f37a15",
    "phone_number_name": "Diwali hoarding - Pune"
  }
}

When a signing secret is set, each request carries X-Edesy-Signature: sha256=<hex>, an HMAC-SHA256 of the raw request body. Compute it over the exact bytes received, before any JSON parsing, and compare in constant time.

// Node.js (Express): verify X-Edesy-Signature over the RAW body
const crypto = require("crypto");

app.post("/webhooks/missed-call", express.raw({ type: "application/json" }), (req, res) => {
  const header = req.get("X-Edesy-Signature") || "";
  const expected = "sha256=" +
    crypto.createHmac("sha256", process.env.EDESY_WEBHOOK_SECRET)
      .update(req.body)            // Buffer, not re-serialised JSON
      .digest("hex");
  const ok = header.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(header), Buffer.from(expected));
  if (!ok) return res.status(401).end();

  res.status(200).end();           // acknowledge fast (within 5 s)
  const event = JSON.parse(req.body.toString("utf8"));
  queueLead(event.data.call_sid, event.data.from); // dedupe on call_sid
});

The same check in Python. If verification fails in your framework, the usual cause is hashing a re-serialised body instead of the raw bytes.

# Python (Flask): verify X-Edesy-Signature over the RAW body
import hmac, hashlib, os
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["EDESY_WEBHOOK_SECRET"].encode()

@app.post("/webhooks/missed-call")
def missed_call():
    raw = request.get_data()                      # bytes exactly as sent
    expected = "sha256=" + hmac.new(SECRET, raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, request.headers.get("X-Edesy-Signature", "")):
        abort(401)
    event = request.get_json()
    queue_lead(event["data"]["call_sid"], event["data"]["from"])  # dedupe on call_sid
    return "", 200                                # reply 2xx within 5 s