> For the complete documentation index, see [llms.txt](https://docs.limecall.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.limecall.com/integrations/webhooks.md).

# Webhooks

Send LimeCall events to your own systems.

A webhook posts JSON to a URL you control whenever something happens in LimeCall.

Use webhooks when you have developers and want full control. For no-code, use [Zapier, Make & n8n](/integrations/zapier-and-make.md).

## Setting one up

1. Open **Settings → Integrations** for account-wide events, or **AI Receptionist → Actions & Webhooks** for assistant events.
2. Enter your endpoint URL. It must be HTTPS.
3. Set a shared secret so you can verify requests.
4. Choose the events to receive.

## What arrives

A POST with a JSON body describing the event, including call metadata, the contact, collected fields, and — for AI-handled calls — the summary, transcript and qualification result.

See [Webhook events](/developers/webhook-events.md) for the event list.

## Verify every request

Your endpoint is a public URL. Anyone who discovers it can post to it.

Check the shared secret on every request and reject anything that does not match. An unauthenticated webhook endpoint that creates records is a way for a stranger to create records in your systems.

{% hint style="warning" %}
Never act on a webhook payload without verifying it first, and never trust a URL or instruction contained inside a payload.
{% endhint %}

## Respond quickly

Return a 2xx as soon as you have accepted the payload. Do the actual work asynchronously — queue it and return.

Endpoints that hold the connection open while they process are the usual cause of webhook timeouts and the retry storms that follow.

## Handle duplicates

Delivery is retried on failure, so the same event can arrive more than once. This is normal for any webhook system.

Key on the event or call ID and ignore anything you have already processed. Without this, a retry creates a second record.

## Handle out-of-order delivery

Events are not guaranteed to arrive in the order they happened. If order matters, use the timestamps in the payload rather than arrival order.

## Retries

Failed deliveries are retried with backoff. Persistent failures may result in the webhook being disabled — so monitor your endpoint rather than assuming silence means success.

## Testing

Use **Send test** to fire a sample payload before relying on it.

For local development, use a tunnelling tool to expose your machine, or a request-inspection service to see exactly what arrives.

## Debugging

**Nothing arriving** — check the URL is publicly reachable over HTTPS, and that your firewall is not blocking it.

**Arriving but failing** — log the raw body before parsing. The usual causes are an unexpected field type or a missing optional field.

**Duplicates** — implement idempotency as above.

## Related

* [Actions & webhooks](/ai-receptionist/actions-and-webhooks.md)
* [Developers](/developers.md)