Shadran API

Authorization: Api-Key caster_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

curl -H "Authorization: Api-Key $KEY" \
  https://pulseem-dialer.com/api/campaigns

curl -H "Authorization: Api-Key $KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"Reminders Q1","retry_count":1}' \
  https://pulseem-dialer.com/api/campaigns

curl -H "Authorization: Api-Key $KEY" \
  -F "file=@reminder.mp3" \
  https://pulseem-dialer.com/api/campaigns/$CAMPAIGN_ID/audio

curl -H "Authorization: Api-Key $KEY" \
  -F "file=@contacts.xlsx" \
  https://pulseem-dialer.com/api/campaigns/$CAMPAIGN_ID/contacts/excel

curl -H "Authorization: Api-Key $KEY" \
  -H "Content-Type: application/json" \
  -d '{"anti_spam_ack":true,"consent_source":"signup form","consent_basis":"prior_consent"}' \
  https://pulseem-dialer.com/api/campaigns/$CAMPAIGN_ID/launch

{
  "detail": {
    "type": "about:blank",
    "title": "Compliance blocked",
    "status": 400,
    "detail": "compliance_blocked",
    "score": 22,
    "failing_checks": [ ... ]
  }
}

import crypto from "node:crypto";

const TOLERANCE_SECONDS = 300;

// rawBody: the request body exactly as received (string or Buffer)
export function verifyCasterSignature(rawBody, header, secret) {
  if (typeof header !== "string") return false;
  const parts = Object.fromEntries(
    header.split(",").map((piece) => piece.trim().split("=", 2)),
  );
  const t = Number(parts.t);
  const v1 = parts.v1;
  if (!Number.isInteger(t) || typeof v1 !== "string") return false;
  if (Math.abs(Date.now() / 1000 - t) > TOLERANCE_SECONDS) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${t}.${rawBody}`)
    .digest("hex");
  const received = Buffer.from(v1, "hex");
  const computed = Buffer.from(expected, "hex");
  // timingSafeEqual throws on different lengths, so compare lengths first
  return received.length === computed.length &&
    crypto.timingSafeEqual(received, computed);
}

// Express: keep the raw body for this route
app.post("/webhooks/caster", express.raw({ type: "application/json" }), (req, res) => {
  const ok = verifyCasterSignature(
    req.body.toString("utf8"),
    req.get("X-Caster-Signature"),
    process.env.CASTER_WEBHOOK_SECRET,
  );
  if (!ok) return res.status(400).send("invalid signature");
  const event = JSON.parse(req.body.toString("utf8"));
  // ... handle event
  res.sendStatus(200);
});

import hashlib
import hmac
import time
from typing import Optional

TOLERANCE_SECONDS = 300


# header: request.headers.get("X-Caster-Signature") -- may be None
def verify_caster_signature(raw_body: bytes, header: Optional[str], secret: str) -> bool:
    if not header:
        return False
    try:
        parts = dict(piece.strip().split("=", 1) for piece in header.split(","))
        t = int(parts["t"])
        v1 = parts["v1"]
    except (AttributeError, KeyError, TypeError, ValueError):
        return False
    if abs(time.time() - t) > TOLERANCE_SECONDS:
        return False
    signed = f"{t}.".encode() + raw_body
    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    # compare bytes: compare_digest raises TypeError on non-ASCII str input
    return hmac.compare_digest(expected.encode(), v1.encode())

# contacts.csv: name,phone,external_contact_id
curl -H "Authorization: Api-Key $KEY" \
  -F "file=@contacts.csv" \
  -F 'column_overrides={"name":0,"phone":1,"metadata_cols":[2]}' \
  https://pulseem-dialer.com/api/campaigns/$CAMPAIGN_ID/contacts/excel

{
  "event_type": "call.ended",
  "campaign_id": "…",
  "attempt_id": "…",
  "contact_id": "…",
  "outcome": "answered_full",
  "listened_seconds": 27.4,
  "listened_pct": 96.1,
  "duration_seconds": 31.0,
  "masked_phone": "+9725****0101",
  "external_contact_id": "CRM-1042",
  "retry_scheduled": false,
  "at": "2026-10-01T09:15:02+00:00"
}