---
title: "Signed-webhook ingest (HMAC; no bearer token)"
method: POST
path: "/api/monitor/ingest"
tags: ["Monitoring"]
---

# Signed-webhook ingest (HMAC; no bearer token)

`POST /api/monitor/ingest`

## Request

- Base URL: `https://api.wordis-bond.com`
- URL: `https://api.wordis-bond.com/api/monitor/ingest`
- Auth: none required

For platform relays that cannot hold an API key. Authenticate with the monitor ingest secret: set wb-timestamp (unix seconds) and wb-signature = hex(HMAC-SHA256(ingestSecret, `${wb-timestamp}.${rawBody}`)). The account is derived from the monitor. A missing/invalid signature is 401.

## Request body

- object: A completed production call to score. The transcript is scored in-flight and never stored.
  - `transcript` string, required: Formatted "AGENT: … / CALLER: …" transcript.
  - `externalId` string, nullable: Your own call id — used to dedupe re-delivery.
  - `platform` string, nullable
  - `durationSec` integer, nullable
  - `occurredAt` string, date-time, nullable
  - `monitorId` string, uuid, required

## Response `202`

Accepted for scoring

- object
  - `data` object, required
    - `status` string
    - `eventId` string
  - `error` union, required
    - object
    - string

## Other responses

- `400`: Missing monitorId / transcript / bad JSON
- `401`: Missing, invalid, or revoked credentials.
- `402`: The plan does not permit this action, or the monthly quota is spent with no overage (e.g. a starter plan attempting a PSTN run). Body carries an upgrade hint; see GET /api/billing/plans.

---

[API](https://skmtc.dev/wordis-bond/apis/word-is-bond-voice-agent-testing-api.md) · [All operations](https://skmtc.dev/wordis-bond/apis/word-is-bond-voice-agent-testing-api/llms.txt) · [OpenAPI document](https://skmtc.dev/wordis-bond/apis/word-is-bond-voice-agent-testing-api/revisions/66c2d5480d84?raw)