Retell Webhooks And Post Call

The operator's webhook endpoint processes call_ended payloads without checking the x-retell-signature header, so anyone can POST forged events.

Verify the x-retell-signature header on every inbound webhook (Retell provides a verify helper in its SDKs) before trusting the payload; reject unsigned/invalid requests. Treat the endpoint as public and the signature as the trust boundary.

The webhook handler reads the call object but ignores the top-level event field, treating call_started and call_ended the same way.

Branch on the top-level event ('call_started' | 'call_ended' | 'call_analyzed' | 'transcript_updated') and only read fields valid for that event — e.g., post-call analysis is present on call_analyzed, not call_started. Do not assume every payload carries every field.

The handler concatenates the transcript_object array into one string and loses speaker attribution and timing.

Iterate transcript_object as an array of role-tagged utterances (agent vs user) preserving order and any timing; keep speaker attribution for QA and compliance review. Do not flatten to an unattributed blob.