Webhooks

Webhooks

Instead of polling the API, webhooks push data to your server the moment something happens in your 6X account. When an event fires, 6X sends an HTTP POST request to your registered endpoint with a signed JSON payload.

Setting up a webhook

1. Log into your business dashboard at app.6xcom.com/dashboard.
2. Go to Webhooks in the sidebar.
3. Click Add Endpoint, enter your server URL, and select the events you want to receive.
4. Copy your Signing Secret — you will need this to verify incoming requests.

Available events

Payload structure

Every webhook delivers the same envelope regardless of event type:

{
  "event": "call.answered",
  "timestamp": "2026-06-21T08:30:00+00:00",
  "business_id": 42,
  "data": {
    "call_id": 198,
    "direction": "inbound",
    "caller": "+447911123456",
    "duration": 120,
    "status": "answered",
    "started_at": "2026-06-21 08:28:00"
  }
}

Verifying the signature

Every request includes an X-6X-Signature header — an HMAC-SHA256 of the raw request body signed with your endpoint secret. Always verify this before processing the payload.

// PHP example
$payload   = file_get_contents('php://input');
$signature = hash_hmac('sha256', $payload, $yourSigningSecret);

if (!hash_equals($signature, $_SERVER['HTTP_X_6X_SIGNATURE'] ?? '')) {
    http_response_code(401);
    exit('Invalid signature');
}

$event = json_decode($payload, true);

// Node.js example
const crypto = require('crypto');
const sig = crypto.createHmac('sha256', signingSecret)
                  .update(rawBody)
                  .digest('hex');
if (sig !== req.headers['x-6x-signature']) {
    return res.status(401).send('Invalid signature');
}

Responding to a webhook

Your endpoint must return a 2xx HTTP status within 10 seconds. If it does not, 6X marks the delivery as failed and retries up to 3 times with a 60-second backoff between attempts.

Delivery logs

Every delivery attempt is logged. Go to Webhooks in your dashboard, then click Logs next to any endpoint to see the full delivery history including response codes, response body, and retry attempts.

Testing your endpoint

Click Test next to any registered endpoint to send a webhook.test event immediately. Use this to confirm your server is receiving and verifying requests correctly before going live.

Limits

Request headers sent by 6X