The call-lifecycle webhook: call_started, call_ended, call_analyzed.

ONE ACCOUNT-LEVEL URL FOR EVERY CALL, so both voice features land here and the discriminator is metadata.kind — which each service checks for itself. A talk-down call advances the call row and, when a second signal from the device agrees, sets announced_at on the reservation.

TEN SECONDS, THREE RETRIES. Retell retries a non-2xx up to three times on a ten-second timeout, so EVERY body the signature admits is answered 200 {} — an unknown event type, another feature's call, an unknown call id. Three redeliveries of a body we would ignore anyway buy nothing, and three duplicate handlings of one we would not are worse.

THE BODY IS BOUNDED BEFORE IT IS PARSED. A transcript and a call analysis arrive in here and are written into a row; a runaway body must not become a multi-megabyte insert, and a failed insert is a 500 that buys two more deliveries of the same body. The adapter caps the two fields; this is the outer bound on the whole payload.