> ## Documentation Index
> Fetch the complete documentation index at: https://docs.voxfra.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> How Voxfra receives call data from your voice AI provider.

## How it works

Voxfra currently accepts inbound webhooks from Vapi on a per-client basis. Each client in your organization gets a **unique Vapi webhook URL**. When a call ends, Vapi posts the call report to that URL and Voxfra handles validation, normalization, and storage.

For the provider-specific reference, see [Vapi](/webhook-integration/vapi).

```text theme={null}
POST https://api.voxfra.com/webhook/vapi/{slug}
```

| Part       | Description                                                          |
| ---------- | -------------------------------------------------------------------- |
| `provider` | Currently `vapi`                                                     |
| `slug`     | Client-specific identifier that maps to your organization and client |

**Example:**

```text theme={null}
POST https://api.voxfra.com/webhook/vapi/abc-motors-vapi-xe9k2a7f
```

***

## Authentication

Each webhook URL uses a **unique slug** as its authentication mechanism. The slug is:

* Unique across the entire platform
* Scoped to exactly one organization + client + provider combination
* Revocable from the admin console at any time

No request headers are required for basic delivery. For additional security, you can optionally enable **HMAC signature verification** when creating or updating a webhook endpoint — Voxfra will validate the provider's request signature before processing the payload.

***

## Processing flow

When a webhook arrives:

1. **Slug resolved** — maps to the correct organization and client
2. **Schema validated** — provider-specific payload checked; returns `400` on mismatch
3. **Idempotency checked** — duplicate call IDs within a 24-hour window are accepted but not reprocessed
4. **Normalized and stored** — call data is extracted, normalized into a unified format, and written to Voxfra
5. **Available** — the call appears in the admin console and via the [Management API](/api-reference/calls/list)

***

## Limits

| Parameter          | Limit                                |
| ------------------ | ------------------------------------ |
| Rate limit         | 1,000 requests / minute per endpoint |
| Body size          | 1 MB                                 |
| Idempotency window | 24 hours (by call ID)                |

***

## Managing webhook URLs

Webhook endpoints are managed in the **Voxfra admin console** under **Settings → Webhooks → Inbound** for each client. You can:

* Create a new URL for a provider
* Copy the URL to paste into your provider's dashboard
* View `last_used_at` and `request_count` per endpoint
* Toggle an endpoint inactive without revoking it
* Revoke and replace a URL if it's compromised
* Configure an IP allowlist or HMAC secret per endpoint

Each client can have one active Vapi webhook endpoint at a time. Additional provider support will be documented here as it becomes available.

***

## Responses

A successful ingestion returns:

```json theme={null}
{
  "success": true,
  "requestId": "req_xe9k2a7f"
}
```

All error responses include a `requestId` for tracing:

| Status | Meaning                                           |
| ------ | ------------------------------------------------- |
| `200`  | Accepted and processed                            |
| `400`  | Payload failed schema validation                  |
| `404`  | Slug not found or endpoint inactive               |
| `429`  | Rate limit exceeded — check `Retry-After` header  |
| `500`  | Internal error — contact support with `requestId` |