Click-to-Call API: Ring the Agent, Then the Customer

The response returns your call_id straight away. Everything else arrives as Call Events.

curl -X POST https://voice-api.edesy.in/v1/click-to-call \
  -H "Authorization: Bearer $EDESY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "agent":    {"phone": "+9198XXXXXXXX"},
    "customer": {"phone": "+9197XXXXXXXX"},
    "caller_id": "+9180XXXXXXXX",
    "correlation": {"crm_call_id": "call_8812", "lead_id": "L-1042"}
  }'

# 201 Created
# {"data": {"call_id": "...", "status": "initiated"}}

A v1 subscription always has a signing secret. Leave it out and Edesy generates one, returned only in this response.

curl -X POST https://voice-api.edesy.in/v1/webhooks/subscriptions \
  -H "Authorization: Bearer $EDESY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://crm.example.com/edesy/call-events",
    "format": "edesy.call.v1",
    "event_types": ["call.completed", "recording.ready", "call.analyzed"]
  }'

HMAC-SHA256 over id.timestamp.body, keyed with the base64 part of your whsec_ secret. Reject timestamps more than 5 minutes off.

const crypto = require('crypto');

function verify(secret, headers, rawBody) {
  const id = headers['webhook-id'];
  const ts = headers['webhook-timestamp'];
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
  const key = Buffer.from(secret.replace(/^whsec_/, ''), 'base64');
  const expected = crypto.createHmac('sha256', key)
    .update(`${id}.${ts}.${rawBody}`).digest('base64');
  const want = Buffer.from(expected);
  return headers['webhook-signature'].split(' ').some((s) => {
    const got = Buffer.from(s.slice(3));
    return s.startsWith('v1,') && got.length === want.length && crypto.timingSafeEqual(got, want);
  });
}