Receive Miraven events in your webhook endpoint

POST /webhooks/miraven HTTP/1.1
Host: api.example.com
Content-Type: application/json
User-Agent: Miraven-Webhooks/1.0
webhook-id: evt_2b7c41e09f6a4b1d8f3e5a7c9d0b1e2f
webhook-timestamp: 1762197124
webhook-signature: v1,33DcwBe0+lAhKqXAgY05/QROBF4z3Xnd7cyJbTZaURY=

{
  "id": "evt_2b7c41e09f6a4b1d8f3e5a7c9d0b1e2f",
  "type": "call.analyzed",
  "created_at": "2026-11-03T19:12:04.000Z",
  "data": {
    "call_id": "6f1d2c3b-8a9e-4f70-b1c2-d3e4f5a6b7c8",
    "agent_id": "39d63614-2b1a-4c5d-9e8f-7a6b5c4d3e2f",
    "caller_phone": "+15551234567",
    "called_phone": "+15557654321",
    "forwarded_from": "+15553334444",
    "funeral_home_phone": "+15553334444",
    "started_at": "2026-11-03T19:05:22.000Z",
    "ended_at": "2026-11-03T19:11:40.000Z",
    "duration_seconds": 378,
    "recording": {
      "url": "https://app.miraven.com/api/recordings/6f1d2c3b-8a9e-4f70-b1c2-d3e4f5a6b7c8?exp=1777835524&sig=EXAMPLE",
      "content_type": "audio/wav",
      "expires_at": "2027-05-04T19:12:04.000Z"
    }
  }
}

import express from "express";
import { Webhook } from "standardwebhooks";

const app = express();
const webhook = new Webhook(process.env.MIRAVEN_WEBHOOK_SECRET); // "whsec_…"

// express.raw keeps the body exactly as it arrived, which verification needs.
app.post("/webhooks/miraven", express.raw({ type: "application/json" }), async (req, res) => {
  let event;
  try {
    event = webhook.verify(req.body, req.headers);
  } catch {
    return res.sendStatus(400);
  }

  // Retries and resends deliver the same event again, with the same id.
  if (await db.processedEvents.has(event.id)) return res.sendStatus(200);

  switch (event.type) {
    case "call.analyzed":
      await queue.add("miraven-call", event.data); // download the recording later, not here
      break;
    default:
      // Ignore event types you don't handle; we add new ones over time.
      break;
  }

  await db.processedEvents.add(event.id);
  res.sendStatus(202);
});

app.listen(3000);

# Any whsec_ secret works for local testing:
node -e "console.log('whsec_' + require('crypto').randomBytes(32).toString('base64'))"

// send-test-event.mjs
// MIRAVEN_WEBHOOK_SECRET=whsec_… node send-test-event.mjs http://localhost:3000/webhooks/miraven
import crypto from "node:crypto";

const url = process.argv[2];
const secret = process.env.MIRAVEN_WEBHOOK_SECRET;

const id = `evt_test_${crypto.randomUUID().replaceAll("-", "")}`;
const now = new Date();
const body = JSON.stringify({
  id,
  type: "call.analyzed",
  created_at: now.toISOString(),
  data: {
    call_id: crypto.randomUUID(),
    agent_id: "00000000-0000-0000-0000-000000000000",
    caller_phone: "+15551234567",
    called_phone: "+15557654321",
    forwarded_from: "+15553334444",
    funeral_home_phone: "+15553334444",
    started_at: new Date(now - 378_000).toISOString(),
    ended_at: now.toISOString(),
    duration_seconds: 378,
    recording: {
      url: "https://app.miraven.com/api/recordings/test", // test events have no real recording
      content_type: "audio/wav",
      expires_at: new Date(+now + 182 * 86_400_000).toISOString(),
    },
  },
});

// Sign it the way Miraven does: HMAC-SHA256 over "id.timestamp.body".
const timestamp = Math.floor(now / 1000);
const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");
const signature = crypto.createHmac("sha256", key).update(`${id}.${timestamp}.${body}`).digest("base64");

const response = await fetch(url, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "webhook-id": id,
    "webhook-timestamp": String(timestamp),
    "webhook-signature": `v1,${signature}`,
  },
  body,
});
console.log(response.status, await response.text());