Docs

API & webhooks

REST API with Bearer keys, plus HMAC-signed webhooks.

Create an API key under Integrations & API → API keys. Keys start with svr_ and are shown once.

List recent calls

curl https://YOUR_APP/api/v1/calls?limit=50 \
  -H "Authorization: Bearer svr_..."

Returns recent calls with summary, QA and lead scores, and cost. limit defaults to 50, max 200.

Place an outbound call

curl -X POST https://YOUR_APP/api/v1/calls/outbound \
  -H "Authorization: Bearer svr_..." \
  -H "Content-Type: application/json" \
  -d '{"agentId":"AGENT_ID","to":"+919876543210"}'

to must be E.164 (+ and country code). The agent must have a phone number attached; it calls from that number.

Webhooks

Add an https URL under Agents → Settings → CRM webhook. After every call we POST a call.completed event.

Header	Value
x-surge-timestamp	Unix seconds when sent
x-surge-signature	sha256=HMAC_SHA256(APP_SECRET, timestamp + "." + body), hex

Verify (Node.js)

import crypto from "node:crypto";

function verify(req, rawBody, secret) {
  const ts = req.headers["x-surge-timestamp"];
  const sig = req.headers["x-surge-signature"] ?? "";
  const expected = "sha256=" + crypto.createHmac("sha256", secret).update(`${ts}.${rawBody}`).digest("hex");
  const fresh = Math.abs(Date.now() / 1000 - Number(ts)) < 300;
  return fresh && sig.length === expected.length && crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
}

Reject requests older than 5 minutes to block replays. Always verify against the raw body, before JSON parsing.

← Previous

Web chat widget

Languages

Want to hear the agent before setting anything up?Try a live demo call