Schedule an AI assistant call via REST — one POST, one webhook, one transcript.

# Exchange username + password for a short-lived OIDC access token.
TOKEN=$(curl -s -X POST "https://phone.yourtenant.com/oidc.ashx/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=password&username=alice&password=YOUR_PASSWORD&scope=openid" \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['access_token'])")

echo "$TOKEN"

import requests

r = requests.post(
    "https://phone.yourtenant.com/oidc.ashx/token",
    data={
        "grant_type": "password",
        "username":   "alice",
        "password":   "YOUR_PASSWORD",
        "scope":      "openid",
    },
    timeout=10,
)
r.raise_for_status()
token = r.json()["access_token"]
print(token)

const body = new URLSearchParams({
  grant_type: "password",
  username:   "alice",
  password:   "YOUR_PASSWORD",
  scope:      "openid",
});

const r = await fetch("https://phone.yourtenant.com/oidc.ashx/token", {
  method: "POST",
  headers: { "Content-Type": "application/x-www-form-urlencoded" },
  body,
});
if (!r.ok) throw new Error(`token ${r.status}`);
const { access_token } = await r.json();
console.log(access_token);

curl -X POST https://phone.yourtenant.com/api.ashx/v1/calls \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "phone":        "+4915157610183",
    "displayName":  "Reminder",
    "email":        "ops@yourcompany.example",
    "systemPrompt": "You are calling Alex to confirm the dentist appointment tomorrow at 14:00. Be brief and warm. If they answer YES, say goodbye. If NO, offer to reschedule for the same time next week.",
    "apiKey":       "YOUR_AI_API_KEY",
    "voice":        "Aoede",
    "language":     "en-US",
    "maxSeconds":   180,
    "retries":      2,
    "retryDelayMinutes": 10
  }'

import requests, os

TOKEN = os.environ["CODEB_TOKEN"]

payload = {
    "phone":        "+4915157610183",
    "displayName":  "Reminder",
    "email":        "ops@yourcompany.example",
    "systemPrompt": (
        "You are calling Alex to confirm the dentist appointment tomorrow "
        "at 14:00. Be brief and warm. If they answer YES, say goodbye. "
        "If NO, offer to reschedule for the same time next week."
    ),
    "apiKey":       os.environ["AI_API_KEY"],
    "voice":        "Aoede",
    "language":     "en-US",
    "maxSeconds":   180,
    "retries":      2,
    "retryDelayMinutes": 10,
}

r = requests.post(
    "https://phone.yourtenant.com/api.ashx/v1/calls",
    headers={"Authorization": f"Bearer {TOKEN}"},
    json=payload,
    timeout=15,
)
r.raise_for_status()
call_id = r.json()["callId"]
print("queued", call_id)

const token  = process.env.CODEB_TOKEN;
const apiKey = process.env.AI_API_KEY;

const r = await fetch("https://phone.yourtenant.com/api.ashx/v1/calls", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${token}`,
    "Content-Type":  "application/json",
  },
  body: JSON.stringify({
    phone:        "+4915157610183",
    displayName:  "Reminder",
    email:        "ops@yourcompany.example",
    systemPrompt: "You are calling Alex to confirm the dentist appointment tomorrow at 14:00. Be brief and warm. If YES, say goodbye. If NO, offer to reschedule for the same time next week.",
    apiKey,
    voice:        "Aoede",
    language:     "en-US",
    maxSeconds:   180,
    retries:      2,
    retryDelayMinutes: 10,
  }),
});
if (!r.ok) throw new Error(`POST ${r.status}: ${await r.text()}`);
const { callId } = await r.json();
console.log("queued", callId);

import hmac, hashlib, os
from flask import Flask, request, abort

WEBHOOK_SECRET = os.environ["CODEB_WEBHOOK_SECRET"].encode()
app = Flask(__name__)

def verify(raw_body: bytes, sig_header: str) -> bool:
    expected = hmac.new(WEBHOOK_SECRET, raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, (sig_header or "").strip())

@app.post("/codeb/webhook")
def hook():
    raw = request.get_data()                        # raw bytes, NOT json()
    sig = request.headers.get("X-CodeB-Signature", "")
    if not verify(raw, sig):
        abort(401)
    evt = request.get_json()                        # now safe to parse
    if evt["type"] == "outbound-ai.finished":
        update_crm(evt["data"]["callId"], evt["data"]["status"])
    return ("", 204)

import express from "express";
import crypto  from "node:crypto";

const SECRET = process.env.CODEB_WEBHOOK_SECRET;
const app = express();

// raw body required for HMAC; capture before json() parses it
app.use("/codeb/webhook", express.raw({ type: "application/json" }));

app.post("/codeb/webhook", (req, res) => {
  const sig = (req.headers["x-codeb-signature"] || "").toString().trim();
  const expected = crypto.createHmac("sha256", SECRET).update(req.body).digest("hex");
  if (!crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) {
    return res.status(401).end();
  }
  const evt = JSON.parse(req.body.toString());
  if (evt.type === "outbound-ai.finished") {
    updateCrm(evt.data.callId, evt.data.status);
  }
  res.status(204).end();
});