Setup
In the dashboard
- Open your agent and go to the Settings tab.
- Under Post-Conversation Webhook, paste your endpoint URL and save.
- Click Test webhook to fire a sample payload so you can verify your server accepts it.
Via API
SetpostConversationWebhookUrl when creating or updating an agent:
null to disable the webhook.
The legacy field name
postCallWebhookUrl is still accepted on create/update for backwards compatibility, but API responses always return postConversationWebhookUrl.Delivery semantics
- Fire-and-forget. Nedzo sends the request but does not retry on failure.
- Timeout. The request is aborted if your server takes longer than 10 seconds to respond.
- Success. Any
2xxstatus is logged as delivered. Non-2xx responses and timeouts are logged but do not retry. - Order. One webhook per conversation, sent after the conversation has been persisted, summary/extraction has run, and the workflow trigger has been queued.
- URL validation. Only
https://(orhttp://for public hosts in development) is allowed. Internal IPs and metadata endpoints are rejected to prevent SSRF. - HIPAA. If the agent has HIPAA compliance enabled,
transcriptis omitted from the payload andsummaryis sent asnull.
Payload
Nedzo sends aPOST request with Content-Type: application/json and a JSON body.
Common fields
Every payload includes these fields, regardless of channel:Voice & Web Agent fields
Chat-only fields
Web Agent fields
Web Agent payloads use the voice-style structure —endedReason, durationSeconds on the root — plus channel: "web".
Example payloads
Voice call
Speaker: text), separated by \n. Split on newlines to reconstruct the turn-by-turn conversation.
Actions log
actions is a chronological array of every tool call the agent ran during the conversation. Each entry has:
Failed tool calls are not emitted. The full unredacted action log (including tool args) is kept on the conversation record itself;
actions here is sanitized for outbound delivery.
When HIPAA compliance is enabled on the agent, actions is sent as an empty array since tool arguments can carry protected health information.
Chat conversation (SMS / Instagram / email / web chat)
[YYYY-MM-DD HH:mm:ss] in your workspace timezone (no offset suffix). If a workspace hasn’t set a timezone, times render in UTC. Strip the leading [...] to recover the plain Speaker: text line.
Web Agent conversation
Field-value typing
analysis.dataExtraction and contact.customFields ship values as the JSON primitive that matches each field’s declared type. The mapping:
Notes:
- A field that is not yet populated for the conversation/contact is omitted from the map rather than emitted as
null. nullincustomFields/dataExtractionalways means the stored value could not be coerced to the declared type — log it on your side if you care about type drift.- Booleans accept canonical
'true'/'false'only (case-insensitive, trimmed). Legacy non-canonical values like'yes'/'1'are intentionally surfaced asnullinstead of silently flipped tofalse. - Dates are emitted as the raw stored string (typically ISO 8601). JSON has no native date type.
Security
- Always use HTTPS. Nedzo blocks requests to non-public IPs and metadata endpoints but you should also refuse plaintext HTTP on your end.
- Verify the source. Nedzo does not currently sign outbound webhooks. If you need to verify the sender, host your endpoint behind an auth gateway, allowlist Nedzo IP ranges, or include a shared secret in the URL path.
- Be idempotent. Use
conversationIdas your idempotency key so duplicate deliveries (e.g. from network retries on your side) don’t create duplicate records.
Related
- Conversation ended workflow trigger — to branch Nedzo workflows after any voice, chat, or web conversation, use this trigger instead of the webhook.
- Workflow webhook trigger — for sending requests into Nedzo from your own systems.
