Integrations and Custom Webhooks

curl -X POST https://api.60db.ai/agents/integrations \
  -H "Authorization: Bearer your-api-key" \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "hubspot",
    "name": "HubSpot (sales)",
    "fields": { "token": "pat-YOUR_TOKEN" }
  }'

"integration_tools": [
  { "connection_id": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d", "tool": "search_contact" },
  { "connection_id": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d", "tool": "create_note" }
]

curl -X PUT https://api.60db.ai/agents/integrations/a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d/agents \
  -H "Authorization: Bearer your-api-key" \
  -H "Content-Type: application/json" \
  -d '{
    "agents": [
      { "agent_id": "9c2e1d7a-0b3f-4e6a-8f1d-5a7b9c0e2d44", "tools": ["book_table", "check_availability"] },
      { "agent_id": "4f1a7b2c-8d3e-4c5f-9a6b-1e2d3c4b5a69", "tools": [] }
    ]
  }'

{
  "success": true,
  "data": {
    "used_by": [
      { "agent_id": "9c2e1d7a-0b3f-4e6a-8f1d-5a7b9c0e2d44", "name": "Front desk", "tools": ["book_table", "check_availability"] }
    ]
  }
}

{ "truncated": true, "preview": "{\"contacts\":[{\"id\":\"..." }

{ "error": "tool_unavailable", "reason": "rate_limited" }

curl -X POST https://api.60db.ai/agents/integrations \
  -H "Authorization: Bearer your-api-key" \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "webhook",
    "name": "Book table",
    "fields": {
      "headers": "X-Api-Key: YOUR_ENDPOINT_KEY",
      "actions": [
        {
          "key": "book_table",
          "name": "Book table",
          "url": "https://hooks.example.com/book",
          "method": "POST",
          "description": "Book a table for a date, time and party size. Call this only after the caller gives all three.",
          "parameters": {
            "type": "object",
            "properties": {
              "date": { "type": "string", "description": "YYYY-MM-DD" },
              "time": { "type": "string", "description": "HH:MM, 24-hour" },
              "guests": { "type": "integer", "description": "Party size" }
            },
            "required": ["date", "time", "guests"]
          },
          "body_template": { "source": "phone" }
        },
        {
          "key": "check_availability",
          "name": "Check availability",
          "url": "https://hooks.example.com/availability",
          "method": "GET",
          "description": "Check the free times on a date for a party size. Call this before booking when the caller has not chosen a time.",
          "parameters": {
            "type": "object",
            "properties": {
              "date": { "type": "string", "description": "YYYY-MM-DD" },
              "guests": { "type": "integer", "description": "Party size" }
            },
            "required": ["date", "guests"]
          }
        }
      ]
    }
  }'

{
  "type": "object",
  "properties": {
    "date": { "type": "string", "description": "YYYY-MM-DD" },
    "guests": { "type": "integer", "description": "Party size" },
    "outdoor": { "type": "boolean", "description": "Seat outside if the caller asks" }
  },
  "required": ["date", "guests"]
}

"plan": { "type": "string", "description": "Plan the caller chose", "enum": ["basic", "pro"] }

{
  "source": "phone",
  "date": "2026-11-05",
  "time": "19:30",
  "guests": 4,
  "_60db": {
    "connection_id": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
    "tool": "webhook_booktable__book_table",
    "call_id": "6b1f0c52-4d7e-4b8a-9d3e-2a1c8e7f0a11",
    "agent_id": "9c2e1d7a-0b3f-4e6a-8f1d-5a7b9c0e2d44"
  }
}

import crypto from 'node:crypto';
import http from 'node:http';

const SECRET = process.env.SIXTYDB_WEBHOOK_SECRET; // whsec_... from create or rotate

function verifySignature({ raw, timestamp, signature, secret }) {
  if (!/^\d+$/.test(timestamp || '') || !/^v1=[a-f0-9]{64}$/.test(signature || '')) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;
  const expected = 'v1=' + crypto.createHmac('sha256', secret)
    .update(timestamp).update('.').update(raw).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

http.createServer((req, res) => {
  const chunks = [];
  req.on('data', (c) => chunks.push(c));
  req.on('end', () => {
    const body = Buffer.concat(chunks);
    const at = req.url.indexOf('?');
    // GET and DELETE: the signed text is the query string as received.
    const raw = req.method === 'GET' || req.method === 'DELETE'
      ? (at === -1 ? '' : req.url.slice(at + 1))
      : body;
    const ok = verifySignature({
      raw,
      timestamp: req.headers['x-60db-timestamp'],
      signature: req.headers['x-60db-signature'],
      secret: SECRET,
    });
    if (!ok) { res.writeHead(401).end(); return; }

    if (req.headers['x-60db-event'] === 'ping') { res.writeHead(200).end(); return; }

    const msg = JSON.parse(body.toString('utf8') || '{}');
    const result = { booked: true, reference: `BK-${msg._60db?.call_id ?? 'manual'}` };
    res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify(result));
  });
}).listen(8080);

import hashlib
import hmac
import os
import time

from flask import Flask, abort, jsonify, request

app = Flask(__name__)
SECRET = os.environ["SIXTYDB_WEBHOOK_SECRET"]  # whsec_... from create or rotate


def verify_signature(raw: bytes, timestamp: str, signature: str, secret: str) -> bool:
    if not (timestamp or "").isdigit() or abs(time.time() - int(timestamp)) > 300:
        return False
    expected = "v1=" + hmac.new(
        secret.encode("utf-8"), f"{timestamp}.".encode("utf-8") + raw, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature or "")


@app.post("/book")
def book():
    raw = request.get_data()  # the exact bytes received
    if not verify_signature(raw, request.headers.get("X-60db-Timestamp", ""),
                            request.headers.get("X-60db-Signature", ""), SECRET):
        abort(401)
    if request.headers.get("X-60db-Event") == "ping":
        return "", 200
    msg = request.get_json()
    call_id = (msg.get("_60db") or {}).get("call_id") or "manual"
    return jsonify(booked=True, reference=f"BK-{call_id}")


@app.get("/availability")
def availability():
    # GET: the signed text is the raw query string, as received.
    if not verify_signature(request.query_string, request.headers.get("X-60db-Timestamp", ""),
                            request.headers.get("X-60db-Signature", ""), SECRET):
        abort(401)
    return jsonify(available=True, slots=["19:30", "20:00"])

POST /book HTTP/1.1
X-60db-Event: ping
X-60db-Timestamp: 1762165200
X-60db-Signature: v1=...
Content-Type: application/json

{ "type": "ping", "connection_id": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d" }

curl -X POST https://api.60db.ai/agents/integrations/a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d/actions/search_contact \
  -H "Authorization: Bearer your-api-key" \
  -H "Content-Type: application/json" \
  -d '{"arguments": {"email": "[email protected]"}}'

{
  "success": true,
  "data": {
    "ok": true,
    "result": { "contacts": [] }
  }
}