WarmTransfer
cdr analytics · published

What a Webex webhook guarantees

Verified 2026-09-16 · 27 sources · tier 2 · 3 disputed

Also known as Notifications in Control Hub, X-Spark-Signature, X-Webex-Signature, firehose webhook, reportId.

Disputed: 3 sources below carry conflicting evidence.

Webex delivers event notifications across multiple webhook mechanisms that differ in configuration, payload structures, and stated guarantees 15. Cisco does not publish unified delivery guarantees across these surfaces, leaving consumers responsible for handling deduplication and reconciliation 3​10.

Webhook Surfaces

The Control Hub notifications webhook and the Webex Calling detailed call records webhook operate as distinct mechanisms with separate setup surfaces, different configuration models, and different payloads, without either article naming the other 15. In the field, the article reached as Enable webhooks for alerts in Control Hub is served under the title Notifications in Control Hub, contains no heading of that name, and uses the word alert 234 times compared to 40 mentions of webhook 5. In addition, the notifications documentation links to a Cisco devices webhook field reference in an external article, marking a 3rd distinct webhook surface 12. WarmTransfer's reading of the sources is that the Webex platform webhooks guide forms a 4th webhook surface alongside the Control Hub alert webhook, the Webex Calling detailed call records webhook, and the Cisco devices webhook reference, serving as the only surface among the 4 that defines a disabling rule, a signature scheme, and verification instructions 21.

The steps for configuring an organisation-wide webhook callback URL name no administrator role, and the word role appears 0 times in the notifications article even though other alert categories in the same text state a role requirement 4. For the Webex Calling detailed call records webhook, sources disagree on the administrative requirements: the article names the required partner role 3 different ways across 3 passages while maintaining a single scope throughout 1. A secret token remains optional across both the notifications and call records webhooks, with both articles pointing readers elsewhere rather than documenting its operation 11.

Control Hub Alert Delivery and Schemas

Webhook delivery is offered for 5 of approximately 12 named alert types, omitted on at least 5 others, and absent from one type that lists no delivery channels 2. For proactive alerts, sources disagree on delivery channel availability: the text states notifications arrive via email, Webex App spaces, or both, but the procedural steps 3 sentences later state that a webhook can be chosen if webhooks are configured at the organisation level 7.

Sources disagree on the alert schema: the article provides 2 incompatible webhook payload schemas sharing 5 field names, differing even in the letter casing of the subtype property 14. In the field, none of the 3 payload examples provided can be parsed, as the introductory example terminates with a trailing comma and the 2 per-alert examples begin with a bare data key lacking an opening curly brace 6.

Platform Disabling Rules and Security

Neither the Control Hub notifications article nor the detailed call records article mentions a retry, a backoff, delivery ordering, a signature scheme, or disabling behavior following repeated failures, with those terms appearing 0 times in both texts 3.

Cisco states that if Webex attempts 100 webhook deliveries within 5 minutes and the receiving server is unreachable or fails to return a 2xx HTTP response code, the webhook is disabled without automatic reactivation 22. Reactivation requires sending an update request to the webhook endpoint with an active status; Cisco states that any webhook re-enabled within 5 minutes of disabling faces a lower failure threshold and disables immediately if the listener is unreachable or fails to respond successfully during that window 24.

Because Cisco continuously adds infrastructure to the Webex cloud, it states that maintaining an IP allowlist is impractical, offering shared-secret cryptographic signatures instead to verify sender identity 27. Webex supports 2 webhook signature headers, with X-Spark-Signature carrying HMAC-SHA1 when created with a secret as a compatibility path, and X-Webex-Signature providing HMAC-SHA256 and HMAC-SHA512 where supported and recommended by Cisco 25:

Header Supported algorithms Status
X-Spark-Signature HMAC-SHA1 Compatibility path when newer signatures are unavailable 25
X-Webex-Signature HMAC-SHA256, HMAC-SHA512 Recommended by Cisco where supported 25

Cisco instructs receivers to calculate the HMAC against the unmodified raw request bytes prior to parsing or re-serializing the JSON, perform signature validation in constant time, and process the header lookup case-insensitively to accommodate HTTP/2 transport 26. Sensitive resource properties like message text are excluded from the webhook body because they are encrypted with room-specific keys not held by the webhook notification service; receiving endpoints must query the API using the payload identifier to fetch full content 23.

For firehose subscriptions, the platform supports single-resource (using the all event) and all-resource models (using all for resource and event), but Cisco restricts firehoses to 3 resources: memberships, messages, and rooms 20. Cisco notes that specifying all as the event covers only created, updated, and deleted events; endpoints tracking meetings started, meetings ended, or participant join and leave events must create separate, explicit webhook registrations 19.

Call Records Reconciliation

Cisco informally claims that detailed call records webhooks reliably deliver records, but notes that duplicate records can arrive during system replays, placing deduplication responsibilities entirely on the consumer 10. The webhook mechanism itself has no retention window; a 30-day availability period applies solely to the pull-based reconciliation and records API interfaces, which serve to recover data missed by a listener 13.

The reconciliation and records APIs enforce this 30-day window via their request parameters: the startTime parameter cannot exceed 30 days into the past relative to current UTC, and endTime must be at least 5 minutes prior to current UTC while remaining within the 30-day boundary 9. These pull interfaces restrict data extraction to a 12-hour maximum query window, constrain partner accounts to 1 initial request per minute per token scope with up to 10 paginated follow-ups, and cap pagination size between 500 and 5000 records per page (defaulting to 5000) 8.

See also

Applicability

Applies to: Cisco Webex Calling. Deployments: multi-tenant. Sources checked 2026-09-16.

What remains uncertain

Whether the platform webhook disabling rule and signature scheme govern the Control Hub alert webhook and the detailed call records webhook is not covered by the sources below. Which Webex Calling resources and events can be subscribed to as webhooks is not covered by the sources below. Whether Webex retries an individual failed webhook delivery at all is not covered by the sources below. Whether the platform retries a failed webhook delivery is not covered by the sources below. Whether webhook notifications arrive in the order the events occurred is not covered by the sources below. Any route to call records older than the reconciliation window is not covered by the sources below. Which webhook types provide the X-Webex-Signature header is not covered by the sources below. Which of the 2 published alert payload schemas is real is not covered by the sources below.

See also

Part of

Related to

Referenced by

Sources

  1. 1
    The detailed call records article names the required partner role 3 different ways in 3 passages, while keeping one scope throughout.disputed
    Detailed call records webhook for Webex Calling in Partner Hub · Detailed call records webhook, webhook setup and Partner API endpoints and the reconciliation endpoint · Checked 2026-09-05
  2. 2
    Webhook delivery is offered for some alert types and not others: 5 of about 12 named types offer it, at least 5 do not, and one type is described with no delivery channel at all.
    Notifications in Control Hub · Notifications in Control Hub, delivery channel steps across the alert type sections · Checked 2026-09-05
  3. 3
    Neither webhook article states a retry, a backoff, a delivery ordering, a signature scheme or a disabling behaviour after repeated failure; those terms occur 0 times in both.
    Detailed call records webhook for Webex Calling in Partner Hub · Detailed call records webhook and Notifications in Control Hub, counted against the rendered article · Checked 2026-09-05
  4. 4
    The steps that set the organisation-wide webhook callback URL name no administrator role, and the word role occurs 0 times in the notifications article, while other alert categories in the same article do name a required role.
    Notifications in Control Hub · Notifications in Control Hub, Set up a webhook callback URL and Enable webhook in a rule · Checked 2026-09-05
  5. 5
    The article reached as Enable webhooks for alerts in Control Hub is served as Notifications in Control Hub, has no heading of that name, and uses the word alert 234 times against 40 for webhook.field report
    Notifications in Control Hub · Notifications in Control Hub, title element and heading extraction · Checked 2026-09-15
  6. 6
    None of the 3 webhook payload examples in the notifications article can be parsed: the introductory one ends with a trailing comma and the 2 per-alert examples open on a bare data key with no enclosing brace.field report
    Notifications in Control Hub · Notifications in Control Hub, the 3 webhook payload examples · Checked 2026-09-05
  7. 7
    The proactive alerts section says notifications are delivered by email, Webex App spaces or both, and its own procedure three sentences later says a webhook may be selected if webhooks are enabled at organisation level.disputed
    Notifications in Control Hub · Notifications in Control Hub, Proactive alerts · Checked 2026-09-05
  8. 8
    The reconciliation and records interfaces cap a query window at 12 hours, rate-limit a partner to one initial request a minute per token scope with up to 10 further paginated requests, and cap a records page between 500 and 5000 with a default of 5000.
    Detailed call records webhook for Webex Calling in Partner Hub · Detailed call records webhook, Partner API endpoints and API Parameters · Checked 2026-09-05
  9. 9
    The Webex Calling reconciliation and records APIs make call records available for 30 days and enforce that window in their own parameters: startTime must not be older than 30 days from the current UTC time and endTime must be at least 5 minutes before the current UTC time and no older than 30 days.
    Detailed call records webhook for Webex Calling in Partner Hub · Data reconciliation, Reconciliation API and Records API parameter lists · Checked 2026-09-16
  10. 10
    Cisco states that the webhooks reliably deliver records and that duplicates may arrive when the system replays records, and makes the consumer responsible for de-duplication.
    Detailed call records webhook for Webex Calling in Partner Hub · Detailed call records webhook, What the Partner webhook delivers · Checked 2026-09-05
  11. 11
    A secret token is optional on both webhooks, and both articles send the reader elsewhere for how it works rather than documenting it.
    Notifications in Control Hub · Notifications in Control Hub, Set up a webhook callback URL, and Detailed call records webhook, webhook setup · Checked 2026-09-05
  12. 12
    The notifications article points at a Cisco devices webhook field reference in a separate article, which is a third webhook surface beside the alert webhook and the detailed call records webhook.
    Notifications in Control Hub · Notifications in Control Hub, Cisco devices webhook field reference · Checked 2026-09-05
  13. 13
    The 30-day availability figure belongs to the reconciliation and records interfaces, which exist to catch up on records a webhook listener may not have received, and no article gives the webhook itself a retention window.
    Detailed call records webhook for Webex Calling in Partner Hub · Detailed call records webhook, Partner API endpoints and API Parameters · Checked 2026-09-05
  14. 14
    The notifications article publishes 2 incompatible webhook payload schemas that share 5 field names, and they differ even in the casing of the subtype field.disputed
    Notifications in Control Hub · Notifications in Control Hub, Set up a webhook callback URL example against the trunk status change and route list calls blocked examples · Checked 2026-09-05
  15. 15
    The Control Hub notifications webhook and the Webex Calling detailed call records webhook are different mechanisms: different setup surfaces, different configuration models and different payloads, and neither article names the other.
    Notifications in Control Hub · Notifications in Control Hub, Set up a webhook callback URL, against the detailed call records webhook article · Checked 2026-09-05
  16. 16
    The article publishes no retry behaviour no rate limit no HTTP method and no signature scheme for the webhook: retry rate limit HMAC signature and content type each occur 0 times.
    Notifications in Control Hub · Notifications in Control Hub, the webhook sections, counted against the rendered article · Checked 2026-09-15
  17. 17
    The words role and permission occur 0 times in the article and no role is named for setting the organisation-wide webhook callback URL that every webhook-delivered alert uses.
    Notifications in Control Hub · Notifications in Control Hub, Set up a webhook callback URL, counted against the rendered article · Checked 2026-09-15
  18. 18
    Two Webex help addresses with different article identifiers serve one rendered article titled Notifications in Control Hub which carries both the alert catalogue and the webhook material and links to itself.field report
    Notifications in Control Hub · Both addresses retrieved and compared by normalised rendered text · Checked 2026-09-15
  19. 19
    Cisco warns that the all event on a firehose webhook covers only created, updated and deleted, and that individual webhooks must still be registered for meetings started and ended and for meeting participant joined and left.
    Webex for Developers — Webhooks · Webhooks guide, Single Resource Firehose section, closing note · Checked 2026-09-16
  20. 20
    The Webex webhooks resource supports firehose subscriptions in 2 forms, a single resource firehose using the all event and an all resource firehose using all for both resource and event, and Cisco states that only 3 resources support them: memberships, messages and rooms.
    Webex for Developers — Webhooks · Webhooks guide, The Firehose Webhook section · Checked 2026-09-16
  21. 21
    The Webex platform webhooks guide is a fourth webhook surface beside the Control Hub alert webhook, the Webex Calling detailed call records webhook and the Cisco devices webhook field reference, and it is the only one of the 4 that publishes a disabling rule, a signature scheme and an instruction for verifying a payload.inferred
    Webex for Developers — Webhooks · Webhooks guide, Disabled Webhooks and Authenticating Requests, read against the 2 Webex Calling webhook help articles · Checked 2026-09-16
  22. 22
    Cisco states that if Webex attempts to deliver 100 webhook notifications within 5 minutes and the target server either becomes unreachable or does not respond with an HTTP code in the 2xx range, the webhook is disabled, and that once disabled it is not re-enabled automatically.
    Webex for Developers — Webhooks · Webhooks guide, Disabled Webhooks section · Checked 2026-09-16
  23. 23
    A Webex webhook payload omits sensitive content such as message text, because Webex encrypts it with keys available only to the members of the space and the webhook request carries no access token with which to decrypt it, so a receiver that needs the content must make an authenticated request for the full resource using the identifier in the payload.
    Webex for Developers — Webhooks · Webhooks guide, Handling Sensitive Data section · Checked 2026-09-16
  24. 24
    A disabled webhook is reactivated through the Update a Webhook endpoint with its status set to active, and Cisco states that a webhook re-enabled within 5 minutes of being automatically disabled has a lower threshold for delivery problems and will be immediately disabled again if the server is unreachable or does not respond successfully during that period.
    Webex for Developers — Webhooks · Webhooks guide, Disabled Webhooks section, final paragraph · Checked 2026-09-16
  25. 25
    Webex supports 2 webhook signature headers: X-Spark-Signature carries an HMAC-SHA1 signature when the webhook was created with a secret, and X-Webex-Signature provides HMAC-SHA256 and HMAC-SHA512 signatures for supported webhook types, with Cisco recommending the second where it is available and naming the first as the compatibility path for webhook types that do not offer it.
    Webex for Developers — Webhooks · Webhooks guide, Authenticating Requests section · Checked 2026-09-16
  26. 26
    Cisco instructs a webhook receiver to compute the HMAC over the unmodified raw request bytes before parsing or re-serialising the JSON, to compare the expected and received signatures in constant time before processing the payload, and to look the header up case-insensitively because Webex may deliver it in lowercase over HTTP/2.
    Webex for Developers — Webhooks · Webhooks guide, Authenticating Requests section · Checked 2026-09-16
  27. 27
    Cisco states that it is continuously adding infrastructure to the Webex cloud so that listing allowed IP addresses is not practical, and that the shared-secret signature is the technique it introduced to let a receiver verify cryptographically that a request came from Cisco.
    Webex for Developers — Webhooks · Webhooks guide, Authenticating Requests section, opening paragraph · Checked 2026-09-16

Documents

tier 2 current vendor documentation

Detailed call records webhook for Webex Calling in Partner Hub

Cisco Systems, Inc. (Webex Help Center) · 2026-08-13 · accessed 2026-09-16

tier 2 current vendor documentation

Notifications in Control Hub

Cisco Systems, Inc. (Webex Help Center) · 2026-08-11 · accessed 2026-09-15

tier 2 current vendor documentation

Webex for Developers — Webhooks

Cisco Systems, Inc. (developer.webex.com) · 2026-09-10 · accessed 2026-09-16

Cite this page

APA

WarmTransfer. (2026, September 16). What a Webex webhook guarantees. WarmTransfer. https://warmtransfer.net/knowledge/webex-calling-webhook-delivery

BibTeX

@misc{warmtransfer-webex-calling-webhook-delivery,
  title  = {What a Webex webhook guarantees},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/webex-calling-webhook-delivery},
  note   = {Verified 2026-09-16}
}