Send Recordings for Review with a Webhook

Use a Webhook Received automation with a Review Meeting action to evaluate recordings stored in your own systems, such as a contact-center platform. For each recording, your system sends one request with the agent’s email, a unique ID and the recording URL. Triple Session downloads the file, and AI Coach evaluates the call and adds it to the agent’s call list. If your security policy requires it, you can also sign requests and download private recordings with a credential.

Requirements

Access to Automations and a company admin role.
Every agent email you send belongs to a Triple Session member of your company with a recording seat, plus standard credits for recordings or VoIP credits for transcripts.
For recordings, a URL that Triple Session can download. See Recording URL.

Set up the automation

Create the automation

Go to Settings > Automations and click New Automation. Set the Trigger to Webhook Received and add a Review Meeting action.

Copy the webhook details

Open the trigger and keep Signed or API key selected under Authentication. Copy these values into your system or automation tool (such as Zapier):

The Webhook URL from Endpoint.
The x-ts-automation-id value from Headers to send.
The Webhook secret, sent in the x-ts-automation-api-key header.

Webhook trigger settings with the Endpoint, the webhook secret and the headers to send

Regenerating the secret breaks senders that use the old one as soon as you save.

Configure the Review Meeting action

Open the Review Meeting action and pick a scorecard. Leave Recording source authentication on None unless your recordings are private (see Recordings behind authentication).

Review Meeting action with Smart Scorecard and recording source authentication set to None

Turn the automation live

Save the automation and click Live. Then send a test notification.

Recording URL

Triple Session downloads each recording_url with a single GET request.

Requirement	Details
Address	An `http://` or `https://` URL on a public hostname. URLs that resolve to private or internal IP addresses are rejected.
Access	A direct download link, such as a public or pre-signed URL. No credentials in the URL. For private storage, see Recordings behind authentication.
File types	`Content-Type` of `audio/wav`, `audio/mpeg`, `audio/mp4` / `audio/x-m4a` (M4A) or `video/mp4`. If the header is missing or `application/octet-stream`, the URL path must end in `.wav`, `.mp3`, `.m4a` or `.mp4`.
Size	Up to 2 GB per file.
Timeouts	Response headers within 30 seconds, and no gap longer than 30 seconds while streaming.
Redirects	Allowed, up to 20.

Notification request

Send one POST request per recording to the Webhook URL from the trigger.

Headers

Header	Value
`content-type`	`application/json`
`x-ts-automation-id`	The `x-ts-automation-id` value from the trigger’s Headers to send.
`x-ts-automation-api-key`	The webhook secret.

To sign requests instead of sending the secret, see Signed requests.

Body

Field	Type	Required	Description
`sales_rep_email`	string	Yes	Email of the Triple Session member who handled the call.
`meeting_id`	string	Recommended	Your unique ID for the recording. Used as the idempotency key.
`recording_url`	string	One of	URL of the file. See Recording URL.
`transcript_body`	string	One of	Transcript text, when there’s no recording. Up to 500,000 characters.
`meeting_name`	string	No	Title shown in Triple Session.
`meeting_date`	string	No	When the call happened. ISO 8601 (`2026-09-29T14:05:00Z`) or a date (`2026-09-29`).
`meeting_duration_in_minutes`	number	No	Call length.
`custom_metadata`	object	No	Extra key-value data stored with the call (up to 10 KB).

Send recording_url or transcript_body. If you send both, the recording is used.

{
  "sales_rep_email": "agent@example.com",
  "meeting_id": "F9-8841239",
  "recording_url": "https://recordings.example.com/files/F9-8841239.wav",
  "meeting_name": "Inbound call - F9-8841239",
  "meeting_date": "2026-09-29T14:05:00Z",
  "meeting_duration_in_minutes": 7
}

Responses

Status	Meaning	What to do
`200` `"Automation started"`	Accepted. Download and evaluation run in the background.	Mark as sent.
`200` `"Meeting already processed"`	This `meeting_id` is being processed or was processed in the last 24 hours.	Treat as sent.
`400`	The body isn’t valid JSON or is missing a required field.	Fix the payload. Don’t retry as is.
`401`	Missing or wrong API key or signature, stale timestamp, signed requests required, or an unknown or paused automation. The `error` field says which.	Fix the headers or the automation. Don’t retry as is.
`413`	Body larger than 1 MB.	Send the recording by URL, not inline.
`429`	Rate limit reached (150 requests per hour per automation by default).	Wait for the number of seconds in `Retry-After`, then retry.
`5xx`	Temporary error.	Retry with exponential backoff.

A meeting_id is accepted once per 24 hours. If its run fails, for example because the download failed, you can re-send the same meeting_id right away once you’ve fixed the cause.

If you expect more than 150 recordings per hour, contact support to raise the limit for your automation.

Sample code

Each sample sends one notification with the API key header. It waits for Retry-After on 429 and backs off exponentially on 5xx or network errors. To sign requests, swap the headers function as shown in Sign each request.

Node.js
PowerShell
curl

Requires Node.js 18 or later.

const WEBHOOK_URL = process.env.TS_WEBHOOK_URL; // from the trigger panel
const AUTOMATION_ID = process.env.TS_AUTOMATION_ID;
const WEBHOOK_SECRET = process.env.TS_WEBHOOK_SECRET;
const MAX_ATTEMPTS = 5;

const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));

function authHeaders(body) {
  return {
    "content-type": "application/json",
    "x-ts-automation-id": AUTOMATION_ID,
    "x-ts-automation-api-key": WEBHOOK_SECRET,
  };
}

export async function notifyTripleSession(recording) {
  const body = JSON.stringify({
    sales_rep_email: recording.agentEmail,
    meeting_id: recording.id,
    recording_url: recording.url,
    meeting_name: recording.name,
    meeting_date: recording.date, // ISO 8601
  });

  for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt += 1) {
    let response;
    try {
      response = await fetch(WEBHOOK_URL, { method: "POST", headers: authHeaders(body), body });
    } catch (error) {
      response = null; // network error: retry below
    }

    if (response?.ok) return response.json();

    const retryable = !response || response.status === 429 || response.status >= 500;
    if (!retryable || attempt === MAX_ATTEMPTS) {
      const detail = response ? `${response.status} ${await response.text()}` : "network error";
      throw new Error(`Triple Session rejected ${recording.id}: ${detail}`);
    }

    const retryAfter = Number(response?.headers.get("retry-after"));
    await sleep(retryAfter > 0 ? retryAfter * 1000 : 2 ** attempt * 1000);
  }
}

Works in Windows PowerShell 5.1 and PowerShell 7.

$WebhookUrl    = $env:TS_WEBHOOK_URL     # from the trigger panel
$AutomationId  = $env:TS_AUTOMATION_ID
$WebhookSecret = $env:TS_WEBHOOK_SECRET

function Get-TripleSessionHeaders([string] $Body) {
  @{
    "x-ts-automation-id"      = $AutomationId
    "x-ts-automation-api-key" = $WebhookSecret
  }
}

function Send-TripleSessionRecording {
  param(
    [Parameter(Mandatory)] [string] $AgentEmail,
    [Parameter(Mandatory)] [string] $RecordingId,
    [Parameter(Mandatory)] [string] $RecordingUrl,
    [string] $MeetingName,
    [string] $MeetingDate,   # ISO 8601
    [int] $MaxAttempts = 5
  )

  $payload = [ordered]@{
    sales_rep_email = $AgentEmail
    meeting_id      = $RecordingId
    recording_url   = $RecordingUrl
  }
  if ($MeetingName) { $payload.meeting_name = $MeetingName }
  if ($MeetingDate) { $payload.meeting_date = $MeetingDate }

  $body = $payload | ConvertTo-Json -Compress
  $utf8 = New-Object System.Text.UTF8Encoding($false)

  for ($attempt = 1; $attempt -le $MaxAttempts; $attempt++) {
    try {
      $response = Invoke-WebRequest -Uri $WebhookUrl -Method Post -UseBasicParsing `
        -ContentType "application/json" -Headers (Get-TripleSessionHeaders $body) -Body $utf8.GetBytes($body)
      return $response.Content | ConvertFrom-Json
    } catch {
      $errorResponse = $_.Exception.Response
      $status = if ($errorResponse) { [int]$errorResponse.StatusCode } else { 0 }  # 0 = network error
      $retryable = $status -eq 0 -or $status -eq 429 -or $status -ge 500
      if (-not $retryable -or $attempt -eq $MaxAttempts) {
        throw "Triple Session rejected ${RecordingId}: status $status. $($_.ErrorDetails.Message)"
      }

      $retryAfter = 0
      if ($errorResponse -and $errorResponse.Headers -is [System.Net.WebHeaderCollection]) {
        [int]::TryParse($errorResponse.Headers["Retry-After"], [ref]$retryAfter) | Out-Null
      } elseif ($errorResponse -and $errorResponse.Headers.RetryAfter.Delta) {
        $retryAfter = [int]$errorResponse.Headers.RetryAfter.Delta.TotalSeconds
      }
      $delay = if ($retryAfter -gt 0) { $retryAfter } else { [math]::Pow(2, $attempt) }
      Start-Sleep -Seconds $delay
    }
  }
}

# Example
Send-TripleSessionRecording -AgentEmail "agent@example.com" -RecordingId "F9-8841239" `
  -RecordingUrl "https://recordings.example.com/files/F9-8841239.wav"

For a one-off manual test.

curl -i -X POST "$TS_WEBHOOK_URL" \
  -H "content-type: application/json" \
  -H "x-ts-automation-id: $TS_AUTOMATION_ID" \
  -H "x-ts-automation-api-key: $TS_WEBHOOK_SECRET" \
  --data '{"sales_rep_email":"agent@example.com","meeting_id":"test-001","recording_url":"https://recordings.example.com/files/test-001.wav"}'

Signed requests

Use signed requests when your own code sends the notifications and your security policy doesn’t allow a shared secret in request headers. Each request carries a signature computed with the webhook secret, so the secret never travels with the request and a captured request stops working after 5 minutes. Tools that can only set fixed headers, such as Zapier, keep using the API key.

Sign each request

Replace the x-ts-automation-api-key header with these two headers:

Header	Value
`x-ts-timestamp`	Current Unix time in seconds, for example `1767225600`.
`x-ts-signature`	`sha256=` followed by the lowercase hex HMAC-SHA256 of `<timestamp>.<raw body>`, keyed with the webhook secret.

Sign the exact string you send: build the JSON body once, then sign and send that string.
The timestamp must be within 5 minutes of Triple Session’s clock. Keep your server’s clock in sync (NTP).
Compute a new timestamp and signature on every retry.
Always send meeting_id. Each is accepted once per 24 hours, so a captured request can’t be replayed.
Don’t also send x-ts-automation-api-key. If both are present, only the signature is checked.

To sign with the sample code above, replace its headers function:

Node.js
PowerShell
curl

import crypto from "node:crypto";

function authHeaders(body) {
  const timestamp = Math.floor(Date.now() / 1000).toString();
  const signature =
    "sha256=" +
    crypto.createHmac("sha256", WEBHOOK_SECRET).update(`${timestamp}.${body}`).digest("hex");

  return {
    "content-type": "application/json",
    "x-ts-automation-id": AUTOMATION_ID,
    "x-ts-timestamp": timestamp,
    "x-ts-signature": signature,
  };
}

function Get-TripleSessionHeaders([string] $Body) {
  $utf8 = New-Object System.Text.UTF8Encoding($false)
  $hmac = New-Object System.Security.Cryptography.HMACSHA256 (, $utf8.GetBytes($WebhookSecret))
  $timestamp = [DateTimeOffset]::UtcNow.ToUnixTimeSeconds().ToString()
  $hash = $hmac.ComputeHash($utf8.GetBytes("$timestamp.$Body"))
  $signature = "sha256=" + (($hash | ForEach-Object { $_.ToString("x2") }) -join "")

  @{
    "x-ts-automation-id" = $AutomationId
    "x-ts-timestamp"     = $timestamp
    "x-ts-signature"     = $signature
  }
}

For a one-off manual test from a shell with openssl.

BODY='{"sales_rep_email":"agent@example.com","meeting_id":"test-001","recording_url":"https://recordings.example.com/files/test-001.wav"}'
TS=$(date +%s)
SIG=$(printf '%s.%s' "$TS" "$BODY" | openssl dgst -sha256 -hmac "$TS_WEBHOOK_SECRET" | sed 's/^.* //')

curl -i -X POST "$TS_WEBHOOK_URL" \
  -H "content-type: application/json" \
  -H "x-ts-automation-id: $TS_AUTOMATION_ID" \
  -H "x-ts-timestamp: $TS" \
  -H "x-ts-signature: sha256=$SIG" \
  --data "$BODY"

Accept only signed requests

Once every sender signs, open the trigger and select Signed requests only under Authentication. Requests without a valid signature are then rejected, including API key requests.

Signed requests only selected, with the timestamp and signature headers to send

Until then, Signed or API key accepts both, so you can move senders over one at a time.

Recordings behind authentication

Use this when your recordings aren’t public and you can’t send pre-signed links. Triple Session downloads each file with a credential that your company admin enters in the Review Meeting action.

Enter the credential

Open the Review Meeting action and fill in Recording source authentication:

Auth type: Basic, Bearer or API key.
Pinned host: the exact hostname of your Recording source, such as recordings.example.com. Add the port only if it isn’t 443.
The credential: username and password, a token, or a header name and value.

Save the action, then the automation. The action then shows Credential saved with a Replace button.

Review Meeting action with Basic recording source authentication, a pinned host and a saved credential

Rotate the credential

Click Replace, enter the new credential and save. The next download uses it. Keep the old credential valid on your side until you’ve saved. Changing the auth type, pinned host or header name requires entering the credential again.

Recording source contract

The Recording source is the HTTPS endpoint that serves your recording files. If your storage can’t serve a file with one plain request, such as SharePoint Online, Amazon S3, Azure Blob Storage or SFTP, put a small HTTPS endpoint in front of it that meets this contract, on top of the Recording URL requirements:

Requirement	Details
Address	`recording_url` must be `https://` on the pinned host, with a valid TLS certificate.
Authentication	Exactly one of: `Authorization: Basic …`, `Authorization: Bearer …`, or a custom header such as `x-api-key: …`. Never put a secret in the URL.
Redirects	The credential is only sent to `https://<pinned host>`. Once a redirect leaves that host, port or scheme, it’s dropped for the rest of the download.

Security

Only the files you point to. Triple Session never lists, scans or polls your storage. Downloaded recordings are stored in Triple Session for transcription and evaluation, like recordings from any other integration.
Entered by your admin only. Never sent through email or Triple Session staff.
Encrypted and write-only. Never shown again, returned by the API or written to logs.
Tied to its host. Sent only over HTTPS to the pinned host.

Use a dedicated, read-only credential. To revoke access, disable it on your side. Downloads then fail with 401 in the run log.

Test the setup

Send one real notification

Use a real recording, the email of a member with a recording seat, and a new meeting_id.

Check the run log

Open the automation, click View Logs and open the run’s Review Meeting action to see its status and any error.If the request returned 200 but no run appears, sales_rep_email doesn’t match a member of your company.

Check the call

The evaluated call appears on the agent’s call list in AI Coach.

Common errors in the run log

Error	Cause
`Recording source returned 401 Unauthorized for <host>`	The recording host rejected the download. Set up Recordings behind authentication or replace the saved credential. Same for `403` and `404`.
`Host <host> is not the pinned host <pinned host>`	With a saved credential, `recording_url` points to a different host than the one you pinned.
`Recording URL must use https when source authentication is configured`	With a saved credential, `recording_url` starts with `http://`.
`Media file URL must resolve only to public IP addresses`	The host resolves to a private or internal address.
`Unsupported file type: text/html…`	The source returned something other than audio or video, often a login page.
`Media response has no Content-Type and URL does not have a supported extension`	Add a `Content-Type` header, or make the URL end in a supported extension.
`Media file is too large. Maximum supported size is 2 GB`	The file is over the size limit.
`Failed to access media file URL: request to <host> failed`	Triple Session couldn’t connect, the TLS handshake failed, or no response arrived within 30 seconds.
`Recording seat required to process review meeting action`	The agent has no recording seat.
`Insufficient standard credits to process review meeting action`	The agent has no standard credits left for a recording.
`Insufficient voip credits to process review meeting action`	The agent has no VoIP credits left for a transcript.

Get Started

AI Coach

AI Coach Bot

Integrations

CRM Sync

Workspace

Automations

Academy

Send Recordings for Review with a Webhook

Requirements

Set up the automation

Recording URL

Notification request

Headers

Body

Responses

Sample code

Signed requests

Sign each request

Accept only signed requests

Recordings behind authentication

Enter the credential

Rotate the credential

Recording source contract

Security

Test the setup

Common errors in the run log

​Requirements

​Set up the automation

​Recording URL

​Notification request

​Headers

​Body

​Responses

​Sample code

​Signed requests

​Sign each request

​Accept only signed requests

​Recordings behind authentication

​Enter the credential

​Rotate the credential

​Recording source contract

​Security

​Test the setup

​Common errors in the run log

Requirements

Set up the automation

Recording URL

Notification request

Headers

Body

Responses

Sample code

Signed requests

Sign each request

Accept only signed requests

Recordings behind authentication

Enter the credential

Rotate the credential

Recording source contract

Security

Test the setup

Common errors in the run log