Webhooks · AnyoneIn API

Webhooks

AnyoneIn POSTs a signed confirmation.updated event to your webhookUrl when a confirmation gets an outcome, gives up or is cancelled.

Set webhookUrl when you create a confirmation and AnyoneIn calls it whenever there's something to act on. There's one event type, confirmation.updated, and its data is the whole confirmation, so you rarely need to call back for more.

Webhook body (abridged)POST to your webhookUrl

{
  "type": "confirmation.updated",
  "data": {
    "id": "cf_7d2a9c41e0b3f658",
    "externalId": "HF-100482",
    "status": "confirmed",
    "outcome": {
      "intent": "alternate_signer",
      "summary": "Confirmed; partner Jo will sign.",
      "signerName": "Jo",
      "preferred": null,
      "newSlot": null,
      "channel": "sms",
      "at": "2026-10-11T12:41:14.906Z"
    },
    "order": {
      "ref": "HF-100482",
      "type": "delivery",
      "date": "2026-10-13",
      "window": { "from": "08:00", "to": "12:00" }
    },
    "steps": [
      { "id": "st_4be1a09c", "channel": "email", "state": "sent", "live": true, "sentAt": "2026-10-10T09:00:02.117Z" },
      { "id": "st_91c3d27e", "channel": "sms", "state": "delivered", "live": true, "sentAt": "2026-10-11T09:00:01.640Z" },
      { "id": "st_0a6f58b2", "channel": "call", "state": "cancelled" }
    ],
    "events": [
      { "kind": "in", "channel": "sms", "text": "I'm at work but my partner Jo will sign", "at": "2026-10-11T12:41:09.302Z" },
      { "kind": "ai", "channel": "sms", "intent": "alternate_signer", "text": "Confirmed; partner Jo will sign." },
      { "kind": "outcome", "channel": "sms", "intent": "alternate_signer", "tone": "good", "text": "Confirmed; partner Jo will sign." }
    ],
    "links": { "customer": "https://api.anyonein.co.uk/c/7d2a9c41e0b3f658.Qm9vS2VkRm9yVHVlc2RheQ" }
  }
}

When it fires

What happened	`data.status`
The customer confirmed, or named someone else who'll be in	`confirmed`
The customer picked one of your `rescheduleOptions`	`rescheduled`
A clear answer that needs a person: a different day, cancel, wrong person, opt-out, wants a person	`action_needed`
Every step went out and nobody answered	`unreachable`
You cancelled it	`cancelled`

It doesn't fire for each email, text or call going out, or while the conversation is still going: you hear about outcomes, not chatter. If a customer writes again after the confirmation has closed and the agent reads a new answer, you get another event with the new status and outcome.

The request

Content-Typeheader: application/json.
X-AnyoneIn-Signatureheader: sha256= followed by the lowercase hex HMAC-SHA256 of the raw request body, keyed with your webhook signing secret.
typestring: Always confirmation.updated today.
dataobject: The full confirmation object, including events.

Verifying signatures

Always check the signature before you trust a webhook. Compute the HMAC-SHA256 of the raw body bytes with your signing secret, add the sha256= prefix, and compare it with the header using a constant-time comparison.

The two mistakes that break verification:

Parsing before hashing. Re-serialising the JSON changes the bytes. Hash the body exactly as it arrived.
Comparing with ==. Use timingSafeEqual, hmac.compare_digest or hash_equals, so the comparison doesn't leak timing.

Roadmap

The signature covers the body only; there's no timestamp in it yet. A signed timestamp for replay protection, and secret rotation with two valid secrets at once, are on the roadmap. Until then, treat events as idempotent (below) and only accept them over https.

import { createHmac, timingSafeEqual } from 'node:crypto';
import express from 'express';

const app = express();

// Verify against the raw bytes, before any JSON parsing.
app.post('/webhooks/anyonein', express.raw({ type: 'application/json' }), (req, res) => {
  const expected = 'sha256=' + createHmac('sha256', process.env.ANYONEIN_WEBHOOK_SECRET)
    .update(req.body)
    .digest('hex');
  const given = req.get('X-AnyoneIn-Signature') ?? '';
  const ok = given.length === expected.length &&
    timingSafeEqual(Buffer.from(given), Buffer.from(expected));
  if (!ok) return res.status(401).end();

  const { type, data } = JSON.parse(req.body);
  if (type === 'confirmation.updated') {
    // data is the full confirmation: data.status, data.outcome, data.externalId ...
  }
  res.sendStatus(204);
});

import hashlib
import hmac
import json
import os

from flask import Flask, abort, request

app = Flask(__name__)
SECRET = os.environ["ANYONEIN_WEBHOOK_SECRET"].encode()

@app.post("/webhooks/anyonein")
def anyonein_webhook():
    raw = request.get_data()  # the exact bytes we signed
    expected = "sha256=" + hmac.new(SECRET, raw, hashlib.sha256).hexdigest()
    given = request.headers.get("X-AnyoneIn-Signature", "")
    if not hmac.compare_digest(given, expected):
        abort(401)

    event = json.loads(raw)
    if event["type"] == "confirmation.updated":
        confirmation = event["data"]  # status, outcome, externalId ...
    return "", 204

<?php
$raw = file_get_contents('php://input');
$expected = 'sha256=' . hash_hmac('sha256', $raw, getenv('ANYONEIN_WEBHOOK_SECRET'));
$given = $_SERVER['HTTP_X_ANYONEIN_SIGNATURE'] ?? '';

if (!hash_equals($expected, $given)) {
    http_response_code(401);
    exit;
}

$event = json_decode($raw, true);
if ($event['type'] === 'confirmation.updated') {
    $confirmation = $event['data']; // status, outcome, externalId ...
}
http_response_code(204);

Handling deliveries

Reply fast. Return any 2xx within 8 seconds, then do the work. The request times out after 8 seconds.
Be idempotent. You may see the same confirmation more than once, and a later event can change an earlier outcome. Key your handling on data.id with data.updatedAt, and let the newest win.
Match it back with data.externalId, your own reference.
Use data.outcome.summary as the note for your team. It's one plain sentence written for ops.

Delivery and retries

Each event is sent once. AnyoneIn records the result on the confirmation as webhook: { "status": 200, "at": "…" } for the response it got, or { "error": "…", "at": "…" } if it couldn't connect.

The URL must be https, and must resolve to a public address. Private and internal addresses are refused.
Redirects aren't followed. Point webhookUrl at the final URL.
The request times out after 8 seconds.

Roadmap

Automatic retries with backoff, a delivery log and a "resend" button are on the roadmap. Until they land, reconcile once a day: list recent confirmations and check any that closed without your system hearing about it. webhook.status tells you what we got back.

Acting on the outcome

Status	Suggested action in your system
`confirmed`	Mark the job ready for dispatch. Pass `outcome.signerName` to the crew
`rescheduled`	Move the booking to `order.date` and `order.window`. The customer has already been told
`action_needed`	Create a task with `outcome.summary`. Check `outcome.intent`: `opt_out` means stop messaging them
`unreachable`	Have someone call before dispatch, or hold the job
`cancelled`	Nothing

Routing by status

switch (c.status) {
  case 'confirmed':
    // Someone will be in. c.outcome.signerName is set if it's not the customer.
    return markReadyForDispatch(c.externalId, c.outcome.signerName);
  case 'rescheduled':
    // They picked one of your slots: the new one is in c.order.
    return moveBooking(c.externalId, c.order.date, c.order.window);
  case 'action_needed':
  case 'unreachable':
    // A person should look before the van leaves.
    return createTask(c.externalId, c.outcome.summary);
  case 'cancelled':
    return; // You cancelled it.
}

Base URL https://api.anyonein.co.uk/v1 is a placeholder until the production domain is confirmed. Found a mistake? Tell us.

#When it fires

#The request

#Verifying signatures

#Handling deliveries

#Delivery and retries

#Acting on the outcome