Add a webhook endpoint
Must be a public https:// URL — private and link-local addresses are refused at save time rather than discovered at delivery time. The signing secret is returned once, here. Subscribe only to what you consume: every delivery is retried up to 14 times over roughly a day.
Requires the admin scope. A key with less gets 403 insufficient_scope.
Authorization: Bearer tone_live_… or tone_test_…. The prefix IS the environment: a test key reaches only the sandbox, and no request field bridges the two.
In: header
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/integrations/webhooks" \ -H "Content-Type: application/json" \ -d '{ "description": "Production CRM sync", "enabled": true, "events": [ "call.completed", "call.failed" ], "url": "https://hooks.example.com/tone" }'{ "data": { "consecutiveFailures": 0, "createdAt": "2026-08-25T09:14:22Z", "description": "Production — order service", "disabledReason": null, "enabled": true, "events": [ "call.completed", "campaign.finished" ], "id": "9f1c2d84-4e3a-4f6c-b902-7d1e8a33c451", "secret": "whsec_3f1a7f6e2b4c4d1e9a8b5c6d7e8f9a0b", "url": "https://hooks.acme.example/tone" }}Recent events (newest first, 30-day retention)
The reconciliation path when a webhook delivery was missed, and the debugging path for "what exactly did Tone send". Deliveries are at-least-once and unordered, so dedupe on the event id.
Recent webhook deliveries
What was sent, what your endpoint answered and how many attempts it took. The place to look when an integration "missed" an event.