One custom-function call.

verify_passcode / disarm / rearm / status belong to voice disarm; report_outcome / request_human to the AI voice talk-down. The name picks the service (see _TOOL_SERVICES), and each service additionally checks the metadata.kind it minted.

IDENTITY COMES FROM call.metadata — which this API minted — and never from args, which an LLM fills in from what the caller said. The service enforces that; the route simply keeps the two fields apart.

THE OPERATION COMES FROM THE SIGNED BODY, NOT FROM THE URL. The signature covers the body and the timestamp only, so the path is unauthenticated routing: handle_tool refuses unless call.name equals the path's tool (missing counts as a mismatch), which is what stops a captured signed status body from being replayed to /tools/rearm.

EVERY ANSWER IS 200 WITH A JSON OBJECT, so Retell can bind response variables and the agent always has a sentence to read.