Webhooks
Webhook endpoints connect provider events to Elaris records and automations.
| Endpoint | Method | Purpose | Protection |
|---|---|---|---|
/twilio/voice | POST | Twilio voice call entrypoint | Twilio signature |
/twilio/status | POST | Twilio call status updates | Twilio signature |
/twilio/sms | POST | SMS reply handling | Twilio signature |
/retell/webhook | POST | Retell call events | Retell signature or secret |
/api/meta/webhook | GET/POST | Meta lead verification and lead events | Verify token + signature |
/api/email-automation/{emailLog}/reply | POST | n8n email reply callback | Shared token |
/api/leads/webhook | POST | n8n lead creation callback | Shared token |
Webhook practices
- Always use HTTPS in production.
- Save raw provider IDs for idempotent updates.
- Log provider failures with status code and body.
- Never trust client-provided ownership fields without server-side checks.
Example shared-token callback
curl -X POST https://app.elarissolutionsllc.com/api/leads/webhook \
-H "Authorization: Bearer $LEADS_WEBHOOK_TOKEN" \
-H "Content-Type: application/json" \
-d '{"name":"Jane Customer","phone":"+15551234567","source":"n8n-gmail"}'