KI-Anruf per REST starten — ein POST, ein Webhook, ein Transkript.

# Benutzername + Passwort gegen kurzlebiges OIDC-Access-Token tauschen.
TOKEN=$(curl -s -X POST "https://phone.ihrtenant.de/oidc.ashx/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=password&username=alice&password=IHR_PASSWORT&scope=openid" \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['access_token'])")

echo "$TOKEN"

import requests

r = requests.post(
    "https://phone.ihrtenant.de/oidc.ashx/token",
    data={
        "grant_type": "password",
        "username":   "alice",
        "password":   "IHR_PASSWORT",
        "scope":      "openid",
    },
    timeout=10,
)
r.raise_for_status()
token = r.json()["access_token"]
print(token)

const body = new URLSearchParams({
  grant_type: "password",
  username:   "alice",
  password:   "IHR_PASSWORT",
  scope:      "openid",
});

const r = await fetch("https://phone.ihrtenant.de/oidc.ashx/token", {
  method: "POST",
  headers: { "Content-Type": "application/x-www-form-urlencoded" },
  body,
});
if (!r.ok) throw new Error(`token ${r.status}`);
const { access_token } = await r.json();
console.log(access_token);

curl -X POST https://phone.ihrtenant.de/api.ashx/v1/calls \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "phone":        "+4915157610183",
    "displayName":  "Erinnerung",
    "email":        "ops@ihrunternehmen.example",
    "systemPrompt": "Du rufst Alex an, um den Zahnarzttermin morgen um 14:00 zu bestaetigen. Sei kurz und freundlich. Wenn JA, verabschiede dich. Wenn NEIN, biete denselben Termin naechste Woche an.",
    "apiKey":       "IHR_AI_API_KEY",
    "voice":        "Aoede",
    "language":     "de-DE",
    "maxSeconds":   180,
    "retries":      2,
    "retryDelayMinutes": 10
  }'

import requests, os

TOKEN = os.environ["CODEB_TOKEN"]

payload = {
    "phone":        "+4915157610183",
    "displayName":  "Erinnerung",
    "email":        "ops@ihrunternehmen.example",
    "systemPrompt": (
        "Du rufst Alex an, um den Zahnarzttermin morgen um 14:00 zu "
        "bestaetigen. Sei kurz und freundlich. Wenn JA, verabschiede "
        "dich. Wenn NEIN, biete denselben Termin naechste Woche an."
    ),
    "apiKey":       os.environ["AI_API_KEY"],
    "voice":        "Aoede",
    "language":     "de-DE",
    "maxSeconds":   180,
    "retries":      2,
    "retryDelayMinutes": 10,
}

r = requests.post(
    "https://phone.ihrtenant.de/api.ashx/v1/calls",
    headers={"Authorization": f"Bearer {TOKEN}"},
    json=payload,
    timeout=15,
)
r.raise_for_status()
call_id = r.json()["callId"]
print("angelegt", call_id)

const token  = process.env.CODEB_TOKEN;
const apiKey = process.env.AI_API_KEY;

const r = await fetch("https://phone.ihrtenant.de/api.ashx/v1/calls", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${token}`,
    "Content-Type":  "application/json",
  },
  body: JSON.stringify({
    phone:        "+4915157610183",
    displayName:  "Erinnerung",
    email:        "ops@ihrunternehmen.example",
    systemPrompt: "Du rufst Alex an, um den Zahnarzttermin morgen um 14:00 zu bestaetigen. Sei kurz und freundlich. Wenn JA, verabschiede dich. Wenn NEIN, biete denselben Termin naechste Woche an.",
    apiKey,
    voice:        "Aoede",
    language:     "de-DE",
    maxSeconds:   180,
    retries:      2,
    retryDelayMinutes: 10,
  }),
});
if (!r.ok) throw new Error(`POST ${r.status}: ${await r.text()}`);
const { callId } = await r.json();
console.log("angelegt", callId);

import hmac, hashlib, os
from flask import Flask, request, abort

WEBHOOK_SECRET = os.environ["CODEB_WEBHOOK_SECRET"].encode()
app = Flask(__name__)

def verify(raw_body: bytes, sig_header: str) -> bool:
    expected = hmac.new(WEBHOOK_SECRET, raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, (sig_header or "").strip())

@app.post("/codeb/webhook")
def hook():
    raw = request.get_data()                        # Rohbytes, NICHT json()
    sig = request.headers.get("X-CodeB-Signature", "")
    if not verify(raw, sig):
        abort(401)
    evt = request.get_json()                        # jetzt sicher parsen
    if evt["type"] == "outbound-ai.finished":
        update_crm(evt["data"]["callId"], evt["data"]["status"])
    return ("", 204)

import express from "express";
import crypto  from "node:crypto";

const SECRET = process.env.CODEB_WEBHOOK_SECRET;
const app = express();

// Rohbody nötig für HMAC; vor json() parsen abfangen
app.use("/codeb/webhook", express.raw({ type: "application/json" }));

app.post("/codeb/webhook", (req, res) => {
  const sig = (req.headers["x-codeb-signature"] || "").toString().trim();
  const expected = crypto.createHmac("sha256", SECRET).update(req.body).digest("hex");
  if (!crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) {
    return res.status(401).end();
  }
  const evt = JSON.parse(req.body.toString());
  if (evt.type === "outbound-ai.finished") {
    updateCrm(evt.data.callId, evt.data.status);
  }
  res.status(204).end();
});