{
  "event": "call.completed",
  "event_id": "f1b6cf7c-…",
  "idempotency_key": "call.completed.123456.primary",
  "attempt_number": 1,
  "is_retry": false,
  "is_test": false,
  "schema_version": "2026-04-28",

  "tenant_id": 42,
  "agent_id": 17,
  "voice_session_id": 123456,

  "call_status": "completed",
  "call_outcome": "answered",
  "answered_by": "human",
  "voicemail_detected": false,
  "amd_category": null,
  "hangup_reason": "user_hangup",

  "started_at": "2026-04-28T20:34:11Z",
  "ended_at": "2026-04-28T20:36:53Z",
  "duration_seconds": 162,

  "transcript_json": [ /* turns */ ],
  "extracted_data": { "name": "…", "email": "…" },
  "tool_calls": [ /* tool name + args + result */ ],

  "analysis_results": [
    {
      "prompt_name": "Sentiment",
      "status": "completed",
      "result": { "label": "positive", "confidence": 0.91 },
      "completed_at": "2026-04-28T20:37:02Z"
    }
  ],
  "analysis_status": "completed",

  "payload_truncated": false,
  "truncated_fields": []
}

import crypto from "crypto";

function verifyWebhook(req, secret) {
  const ts = req.header("x-webhook-timestamp");
  const sigHeader = req.header("x-webhook-signature-v1");
  if (!ts || !sigHeader) return false;

  // Reject replays
  const ageSec = Math.abs(Date.now() / 1000 - Number(ts));
  if (ageSec > 5 * 60) return false;

  // Compute expected
  const signed = `${ts}.${req.rawBody}`;
  const expected = crypto.createHmac("sha256", secret).update(signed).digest("hex");

  // Header may contain multiple comma-separated v1=<hex> entries during rotation.
  const candidates = sigHeader.split(",").map(s => s.trim().replace(/^v1=/, ""));
  return candidates.some(hex =>
    hex.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(hex, "hex"), Buffer.from(expected, "hex"))
  );
}

import hmac, hashlib, time

def verify(headers, body, secret):
    ts = headers.get("X-Webhook-Timestamp")
    sig_header = headers.get("X-Webhook-Signature-V1")
    if not ts or not sig_header:
        return False
    if abs(time.time() - int(ts)) > 300:
        return False
    expected = hmac.new(secret.encode(), f"{ts}.{body}".encode(), hashlib.sha256).hexdigest()
    candidates = [s.strip().removeprefix("v1=") for s in sig_header.split(",")]
    return any(hmac.compare_digest(c, expected) for c in candidates)