Retell Webhooks And Post Call

The operator's webhook endpoint processes call_ended payloads without checking the x-retell-signature header, so anyone can POST forged events.

Verify the x-retell-signature header on every inbound webhook (Retell provides a verify helper in its SDKs) before trusting the payload; reject unsigned/invalid requests. Treat the endpoint as public and the signature as the trust boundary.

The webhook handler reads the call object but ignores the top-level event field, treating call_started and call_ended the same way.

Branch on the top-level event ('call_started' | 'call_ended' | 'call_analyzed' | 'transcript_updated') and only read fields valid for that event — e.g., post-call analysis is present on call_analyzed, not call_started. Do not assume every payload carries every field.

The integrator expects all data on call_ended and finalizes the record there, but post-call analysis only arrives later on call_analyzed.

Expect call_analyzed after call_ended (analysis is computed post-call) and update the record when it arrives — do not finalize/close before call_analyzed if you need sentiment/disposition/summary. Key both events on call_id.