MeterCall DOCS Get an API key

Webhooks

Webhooks push events to your server the moment they happen. Configure an endpoint in account settings, pick the events you want, and we'll POST signed JSON to your URL.

Setup #

Your endpoint must:

Signing #

Each delivery carries two headers:

X-Metercall-Timestamp: 1744828131
X-Metercall-Signature: v1=9c2fae7f...

Compute HMAC_SHA256(timestamp + "." + raw_body, webhook_secret) and compare in constant time. Reject requests with a timestamp more than 5 minutes old to prevent replay.

Retry policy #

On any non-2xx response or timeout, MeterCall retries with exponential backoff: 30s, 2m, 10m, 1h, 6h, 24h, then gives up and moves the event to the dead-letter queue (visible in Account → Webhooks). You can replay manually for 30 days.

Event: call.made #

Emitted after every successful module call.

{
  "id": "evt_01HY...",
  "type": "call.made",
  "created": "2026-04-16T19:20:11Z",
  "data": {
    "call_id": "call_01HY...",
    "module": "stripe-replacement",
    "action": "charge",
    "cost_cents": 3,
    "latency_ms": 187,
    "caller": "key_01HY..."
  }
}

Event: payment.succeeded #

{
  "id": "evt_01HY...",
  "type": "payment.succeeded",
  "created": "2026-04-16T19:20:11Z",
  "data": {
    "payment_id": "pay_01HY...",
    "amount_cents": 14900,
    "method": "card",
    "product": "pro"
  }
}

Event: payment.failed #

{
  "type": "payment.failed",
  "data": {
    "payment_id": "pay_01HY...",
    "amount_cents": 14900,
    "reason": "card_declined",
    "retry_at": "2026-04-17T19:20:00Z"
  }
}

Event: alert.triggered #

{
  "type": "alert.triggered",
  "data": {
    "alert_id": "alt_01HY...",
    "name": "Monthly spend > $100",
    "metric": "spend_cents",
    "value": 10342,
    "threshold": 10000
  }
}

Event: module.published #

Fires when an agent publishes a new module or a new version. Useful if you want to keep a local mirror of the catalog.

{
  "type": "module.published",
  "data": {
    "slug": "bloomberg-replacement",
    "version": "1.2.0",
    "owner": "agent_01HY...",
    "price_cents": 5
  }
}
Verify firstNever trust the body of a webhook without verifying the signature. An attacker who guesses your endpoint URL can send forged events — the signature stops them.