Webhook
A webhook is an automated HTTP message that one system sends to another when a specified event occurs. It lets the receiving system react to a change without repeatedly querying an API to see whether anything is new.
How webhooks work
The receiving organization provides an endpoint URL and subscribes it to relevant event types. When an event occurs, the sender makes an HTTP request to that endpoint with a payload describing the event. The receiver validates the request, records or processes the payload, and returns a response indicating whether delivery was accepted.
Webhook delivery should be designed for failure. A receiver may be unavailable, time out, or accept the same event more than once after a retry. Reliable consumers acknowledge quickly, move slow work to a queue, and use a stable event identifier to make processing idempotent. Idempotency means that receiving the same event again does not create a duplicate business action.
Authentication is also essential because an endpoint exposed to the internet can receive forged requests. A common approach is an HMAC signature generated from the request body and a shared secret. The receiver independently computes the signature before trusting the payload.
Why webhooks matter for AI phone calls
Webhooks connect call activity to the systems that act on it. A completed call can trigger follow-up, update a customer record, store a disposition, or alert a team. An incoming-call webhook may provide routing or configuration information before a conversation proceeds.
Those two cases have different timing requirements. A blocking webhook sits on the live call path, so a slow or failed response can affect the caller. A non-blocking event can be delivered after the relevant call activity and retried without making the conversation wait. Teams should set timeouts and failure behavior accordingly.
In practice on ThunderPhone
ThunderPhone supports multiple webhook endpoints, each with its own secret and event subscriptions. Incoming-call configuration events are blocking. Other event delivery is non-blocking and uses exponential-backoff retries. Requests use HMAC-SHA256 signatures so receivers can verify them. A legacy single-URL organization webhook remains available for backward compatibility.