Vapi Webhooks

Vapi is a voice-AI agent platform (assistants place and receive phone calls, plus chat/session APIs). Its webhook endpoint is called the Server URL. It is bidirectional: most messages are fire-and-forget notifications, but four message types require your endpoint to return a meaningful JSON response body — not just 200 OK — because Vapi uses your answer to drive the live call.

When to Use This Skill

• How do I receive Vapi webhooks / configure the Server URL?
• How do I authenticate a Vapi webhook? Which header carries the secret?
• Why is there no fixed HMAC signature to verify?
• How do I respond to assistant-request, tool-calls, transfer-destination-request, or knowledge-base-request?
• How do I read the event type — why is it at message.type, not the top level?

Verification (core)