Webhooks
Every call event,POSTed to your server.
Your server gets a POST when anything happens on a call. Deliveries are signed, go only to hosts you allow, and retry when your endpoint is down. Self-serve subscription management is in preview.
The event wire
Watch a call move. Watch your server hear about it.
As a call moves through its lifecycle, each event drops onto the wire and is delivered to your endpoint. If your server does not answer, delivery retries until it does, without hammering you.
The lifecycle
Nine real events, fired as a call moves.
These are the lifecycle events the platform emits today, not a wishlist. Subscribe to the ones your application cares about.
Delivery & security
Signed, allow-listed, retried.
Built on the egress that already runs Dial. Verify the signature, acknowledge with a 200, do the heavy work out of band.
Signed delivery, encrypted secrets
Every delivery carries an X-TelVox-Signature header. Per-subscription signing secrets are stored encrypted, and you verify the signature so you can trust the sender and reject replays.
Retry, rate-limit and timeout handling
Deliveries retry on failure, respect rate limits and honor timeouts, so a slow or briefly down endpoint does not lose events or get hammered.
Per-org SSRF-safe allow-list
Egress goes only to hosts on your organization's allow-list, behind an SSRF guard that blocks internal, loopback and cloud-metadata addresses. The same safe egress that powers Dial's integrations.
Custom headers and JSON templates
Attach custom headers and shape the payload with JSON templates, so deliveries fit the contract your endpoint already expects. Send sync or async.
Inbound event injection
Push leads and events back into TelVox over a token plus IP-allowlisted inbound endpoint, so your systems can drive flows. A real, shipped capability.
// illustrative: shape may differ at GA
// TelVox POSTs to the URL you configured, with your custom headers
POST https://your.app/hooks/telvox
X-TelVox-Signature: t=1718900000,v1=9f86d081...
X-TelVox-Event: call-start
{
"event": "call-start",
"call_sid": "CA8a1b...",
"from": "+14155550100",
"to": "+14155550199",
"direction": "inbound",
"occurred_at": "2026-06-22T15:04:01Z"
}// illustrative: shape may differ at GA
// acknowledge fast; do heavy work async
app.post("/hooks/telvox", (req, res) => {
if (!verify(req.headers["x-telvox-signature"], req.rawBody)) {
return res.status(403).end();
}
enqueue(req.body); // process out of band
res.status(200).end(); // ack within the timeout window
});Honest status: the nine events, retries, encrypted secrets, the SSRF-safe allow-list and inbound injection all run in Dial today. The self-serve subscription-management REST surface is versioned v0.x, and the snippets here are illustrative.
Questions
Webhooks FAQ
Which events can I subscribe to?
The nine real lifecycle events that fire today in Dial: web-form, call-start, hangup, no-agent, disposition, callback, queued, abandoned and voicemail-left. These are not placeholders; they are the events the platform already emits. The self-serve REST surface for managing subscriptions is in preview.
How is webhook egress kept safe?
Deliveries only go to hosts on your organization's allow-list, behind an SSRF guard that refuses internal, loopback and cloud-metadata addresses. Each delivery is signed so you can verify authenticity and reject replays, and signing secrets are stored encrypted. This is the same hardened egress that runs Dial's integrations.
What happens if my endpoint is slow or down?
Deliveries retry on failure, respect rate limits and honor a timeout, so transient slowness or a brief outage doesn't drop events. Acknowledge fast with a 200 and do heavy processing out of band: verify the signature first, enqueue the payload, then return.
Can I push events into TelVox, not just receive them?
Yes. There's a real inbound injection path, protected by a token plus an IP allow-list, for pushing leads and events back into the platform so your systems can drive flows. The outbound subscription-management API and inbound shapes shown here are illustrative; exact fields may change before GA.
Wire call events into your systems.
Sign up and we will set up event delivery to your endpoints over signed, SSRF-safe egress.