Webhooks

A webhook sends events to your URL, for example as soon as a summary is ready. These endpoints register and manage webhooks.

Every endpoint below shows its parameters and response fields in the middle and a request sample with an example response on the right.

Base URL https://api.sally.ioVersion v1.0 current, not frozen yetHow versioning works

Lists the registered webhooks

GET/v1.0/directories/{directoryId}/webhooks

Admins/owners see all webhooks of the directory (both personal and directory-wide); a regular user only sees their own (personal) webhooks.

Field overview from the specification

Each item has:

• webhookId (string): id of the webhook.
• name (string): display name of the webhook.
• event (string enum): when the webhook fires. summary.ready after every summary, manual never on its own (it is started from the meeting or recording). Webhooks created before the current trigger model may still report recording.summarized or meeting.summarized; those two cannot be set any more.
• url (string): target URL that Sally POSTs the event to.
• isActive (boolean): whether the webhook is actively firing.
• directoryWide (boolean): whether the webhook fires directory-wide (for recordings of ALL users, admin/owner only) or personally (only for the creator's own recordings).
• createdOn (string): creation timestamp (ISO-8601).

Path parameters

• directoryIdstringrequired

  Id of the directory (the Sally company account) the resource belongs to. The directories a token can address are listed by GET /v1.0/me/directories/memberships.

Query parameters

• fieldsstringoptional

  Comma-separated list of the fields to return. Leave it out and you get every field — including fields added in the future, which is your call to make: name your fields if you want to be shielded from that.

  Only first-level fields can be named. A nested list such as attendees, tags or sectionItems is returned whole or not at all; attendees.name is not supported.

  On a paged response the selection applies to the entries in items; page, pageSize, total and hasMore are always returned. An unknown name is rejected with 400 rather than ignored.

  Selectable here: createdOn, directoryWide, event, isActive, name, url, webhookId.

  Example: createdOn,directoryWide

Response

• webhookIdstringrequired

  Id of the webhook.

• namestringrequired

  Display name of the webhook.

• eventstringrequired

  Event on which the webhook fires.

  Allowed values: summary.readymanualrecording.summarizedmeeting.summarized
• urlstringrequired

  Target URL that Sally POSTs the event to.

• isActivebooleanrequired

  Whether the webhook is actively firing.

• directoryWidebooleanrequired

  Whether the webhook fires directory-wide (for recordings of ALL users, admin/owner only) or personally (only for the creator's own recordings).

• createdOnstringrequired

  Creation timestamp (ISO-8601).

Status codes

• 200Success
• 400

  Invalid request (validation error).

• 401

  Missing or invalid bearer token.

• 404

  Resource not found or not accessible.

• 429

  Rate limit exceeded (per token/IP). Transcription uploads may also return code FUP_LIMIT_EXCEEDED or TOO_MANY_CONCURRENT_TRANSCRIPTIONS.

• 500

  Internal server error.

Request

cURL

curl "https://api.sally.io/v1.0/directories/$DIRECTORY_ID/webhooks" \
  -H "Authorization: Bearer $SALLY_TOKEN"

JavaScript

const response = await fetch(`https://api.sally.io/v1.0/directories/${directoryId}/webhooks`, {
  headers: {
    Authorization: `Bearer ${process.env.SALLY_TOKEN}`,
  },
});
const data = await response.json();

Python

import os
import requests

response = requests.get(
    f"https://api.sally.io/v1.0/directories/{directory_id}/webhooks",
    headers={"Authorization": f"Bearer {os.environ['SALLY_TOKEN']}"},
)
data = response.json()

Response example 200 OK

[
  {
    "webhookId": "af39409b-ca90-443d-a5e8-47dfd97c518f",
    "name": "CRM sync",
    "event": "summary.ready",
    "url": "https://example.com/hooks/sally",
    "isActive": true,
    "directoryWide": true,
    "createdOn": "2026-09-24T09:30:00Z"
  }
]

Registers a webhook (fires after the summary)

POST/v1.0/directories/{directoryId}/webhooks

Sally POSTs to the given URL when the event fires (payload: summary + custom insights + section items).

Field overview from the specification

Body fields:

• url (string, required): the endpoint Sally sends the POST request to.
• event (string, optional, default summary.ready): summary.ready fires after every summary, manual never fires on its own and is started from the meeting or recording. The event that triggers the webhook.
• name (string, optional): a label to recognize the webhook in the list.
• directoryWide (boolean, optional, default false): false = personal webhook, fires only for the creator's own recordings; true = fires for the recordings of ALL users (reserved for admins/owners).

Path parameters

• directoryIdstringrequired

  Id of the directory (the Sally company account) the resource belongs to. The directories a token can address are listed by GET /v1.0/me/directories/memberships.

Query parameters

• fieldsstringoptional

  Comma-separated list of the fields to return. Leave it out and you get every field — including fields added in the future, which is your call to make: name your fields if you want to be shielded from that.

  Only first-level fields can be named. A nested list such as attendees, tags or sectionItems is returned whole or not at all; attendees.name is not supported.

  On a paged response the selection applies to the entries in items; page, pageSize, total and hasMore are always returned. An unknown name is rejected with 400 rather than ignored.

  Selectable here: createdOn, directoryWide, event, isActive, name, url, webhookId.

  Example: createdOn,directoryWide

Request body application/json

• urlstringrequired
  Example: https://example.com/sally-webhook
• eventstringoptional
  Allowed values: summary.readymanual

  Example: summary.ready
• namestringoptional
  Example: Mein CRM-Sync
• directoryWidebooleanoptional
  Example: false

Response

• webhookIdstringrequired

  Id of the webhook.

• namestringrequired

  Display name of the webhook.

• eventstringrequired

  Event on which the webhook fires.

  Allowed values: summary.readymanualrecording.summarizedmeeting.summarized
• urlstringrequired

  Target URL that Sally POSTs the event to.

• isActivebooleanrequired

  Whether the webhook is actively firing.

• directoryWidebooleanrequired

  Whether the webhook fires directory-wide (for recordings of ALL users, admin/owner only) or personally (only for the creator's own recordings).

• createdOnstringrequired

  Creation timestamp (ISO-8601).

Status codes

• 200Success
• 400

  Invalid request (validation error).

• 401

  Missing or invalid bearer token.

• 403

  Forbidden (insufficient permissions).

• 404

  Resource not found or not accessible.

• 429

  Rate limit exceeded (per token/IP). Transcription uploads may also return code FUP_LIMIT_EXCEEDED or TOO_MANY_CONCURRENT_TRANSCRIPTIONS.

• 500

  Internal server error.

Request

cURL

curl -X POST "https://api.sally.io/v1.0/directories/$DIRECTORY_ID/webhooks" \
  -H "Authorization: Bearer $SALLY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "url": "https://example.com/sally-webhook",
  "event": "summary.ready",
  "name": "Mein CRM-Sync",
  "directoryWide": false
}'

JavaScript

const response = await fetch(`https://api.sally.io/v1.0/directories/${directoryId}/webhooks`, {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.SALLY_TOKEN}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "url": "https://example.com/sally-webhook",
    "event": "summary.ready",
    "name": "Mein CRM-Sync",
    "directoryWide": false
  }),
});
const data = await response.json();

Python

import os
import requests

response = requests.post(
    f"https://api.sally.io/v1.0/directories/{directory_id}/webhooks",
    headers={"Authorization": f"Bearer {os.environ['SALLY_TOKEN']}"},
    json={
        "url": "https://example.com/sally-webhook",
        "event": "summary.ready",
        "name": "Mein CRM-Sync",
        "directoryWide": False,
    },
)
data = response.json()

Response example 200 OK

{
  "webhookId": "af39409b-ca90-443d-a5e8-47dfd97c518f",
  "name": "CRM sync",
  "event": "summary.ready",
  "url": "https://example.com/hooks/sally",
  "isActive": true,
  "directoryWide": true,
  "createdOn": "2026-09-24T09:30:00Z"
}

Updates a webhook (url, event, name)

PATCH/v1.0/directories/{directoryId}/webhooks/{webhookId}

Partial update — only the fields present in the body change; the others stay as they are. Activating/deactivating is NOT done here but via the separate activate/deactivate endpoints. Same permissions as delete: a regular user can only change their own (personal) webhooks; admins/owners can change any webhook of the directory.

Field overview from the specification

Body fields:

• url (string, optional): new HTTPS endpoint Sally POSTs to.
• event (string, optional): new event that triggers the webhook.
• name (string, optional): new label to recognize the webhook in the list.

Path parameters

• directoryIdstringrequired

  Id of the directory (the Sally company account) the resource belongs to. The directories a token can address are listed by GET /v1.0/me/directories/memberships.

• webhookIdstringrequired

  Id of the webhook.

Query parameters

• fieldsstringoptional

  Comma-separated list of the fields to return. Leave it out and you get every field — including fields added in the future, which is your call to make: name your fields if you want to be shielded from that.

  Only first-level fields can be named. A nested list such as attendees, tags or sectionItems is returned whole or not at all; attendees.name is not supported.

  On a paged response the selection applies to the entries in items; page, pageSize, total and hasMore are always returned. An unknown name is rejected with 400 rather than ignored.

  Selectable here: createdOn, directoryWide, event, isActive, name, url, webhookId.

  Example: createdOn,directoryWide

Request body application/json

• urlstringoptional
  Example: https://example.com/sally-webhook
• eventstringoptional
  Allowed values: summary.readymanual

  Example: summary.ready
• namestringoptional
  Example: Mein CRM-Sync

Response

• webhookIdstringrequired

  Id of the webhook.

• namestringrequired

  Display name of the webhook.

• eventstringrequired

  Event on which the webhook fires.

  Allowed values: summary.readymanualrecording.summarizedmeeting.summarized
• urlstringrequired

  Target URL that Sally POSTs the event to.

• isActivebooleanrequired

  Whether the webhook is actively firing.

• directoryWidebooleanrequired

  Whether the webhook fires directory-wide (for recordings of ALL users, admin/owner only) or personally (only for the creator's own recordings).

• createdOnstringrequired

  Creation timestamp (ISO-8601).

Status codes

• 200Success
• 400

  Invalid request (validation error).

• 401

  Missing or invalid bearer token.

• 403

  Forbidden (insufficient permissions).

• 404

  Resource not found or not accessible.

• 429

  Rate limit exceeded (per token/IP). Transcription uploads may also return code FUP_LIMIT_EXCEEDED or TOO_MANY_CONCURRENT_TRANSCRIPTIONS.

• 500

  Internal server error.

Request

cURL

curl -X PATCH "https://api.sally.io/v1.0/directories/$DIRECTORY_ID/webhooks/$WEBHOOK_ID" \
  -H "Authorization: Bearer $SALLY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "url": "https://example.com/sally-webhook",
  "event": "summary.ready",
  "name": "Mein CRM-Sync"
}'

JavaScript

const response = await fetch(`https://api.sally.io/v1.0/directories/${directoryId}/webhooks/${webhookId}`, {
  method: 'PATCH',
  headers: {
    Authorization: `Bearer ${process.env.SALLY_TOKEN}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "url": "https://example.com/sally-webhook",
    "event": "summary.ready",
    "name": "Mein CRM-Sync"
  }),
});
const data = await response.json();

Python

import os
import requests

response = requests.patch(
    f"https://api.sally.io/v1.0/directories/{directory_id}/webhooks/{webhook_id}",
    headers={"Authorization": f"Bearer {os.environ['SALLY_TOKEN']}"},
    json={
        "url": "https://example.com/sally-webhook",
        "event": "summary.ready",
        "name": "Mein CRM-Sync",
    },
)
data = response.json()

Response example 200 OK

{
  "webhookId": "af39409b-ca90-443d-a5e8-47dfd97c518f",
  "name": "CRM sync",
  "event": "summary.ready",
  "url": "https://example.com/hooks/sally",
  "isActive": true,
  "directoryWide": true,
  "createdOn": "2026-09-24T09:30:00Z"
}

Deletes (deactivates) a webhook

DELETE/v1.0/directories/{directoryId}/webhooks/{webhookId}

Soft delete (active=false) per Sally convention. A regular user can only delete their own (personal) webhooks; admins/owners can delete any webhook of the directory.

Path parameters

• directoryIdstringrequired

  Id of the directory (the Sally company account) the resource belongs to. The directories a token can address are listed by GET /v1.0/me/directories/memberships.

• webhookIdstringrequired

  Id of the webhook.

Status codes

• 204Success
• 400

  Invalid request (validation error).

• 401

  Missing or invalid bearer token.

• 403

  Forbidden (insufficient permissions).

• 404

  Resource not found or not accessible.

• 429

  Rate limit exceeded (per token/IP). Transcription uploads may also return code FUP_LIMIT_EXCEEDED or TOO_MANY_CONCURRENT_TRANSCRIPTIONS.

• 500

  Internal server error.

Request

cURL

curl -X DELETE "https://api.sally.io/v1.0/directories/$DIRECTORY_ID/webhooks/$WEBHOOK_ID" \
  -H "Authorization: Bearer $SALLY_TOKEN"

JavaScript

const response = await fetch(`https://api.sally.io/v1.0/directories/${directoryId}/webhooks/${webhookId}`, {
  method: 'DELETE',
  headers: {
    Authorization: `Bearer ${process.env.SALLY_TOKEN}`,
  },
});
console.log(response.status); // 204

Python

import os
import requests

response = requests.delete(
    f"https://api.sally.io/v1.0/directories/{directory_id}/webhooks/{webhook_id}",
    headers={"Authorization": f"Bearer {os.environ['SALLY_TOKEN']}"},
)
print(response.status_code)  # 204

Response example 204 No Content

No content. A successful call returns an empty body.

Activates a webhook

POST/v1.0/directories/{directoryId}/webhooks/{webhookId}/activate

Resumes a paused webhook so it fires again. No request body. Same permissions as delete: a regular user can only change their own (personal) webhooks; admins/owners can change any webhook of the directory. Returns the updated webhook.

Path parameters

• directoryIdstringrequired

  Id of the directory (the Sally company account) the resource belongs to. The directories a token can address are listed by GET /v1.0/me/directories/memberships.

• webhookIdstringrequired

  Id of the webhook.

Query parameters

• fieldsstringoptional

  Comma-separated list of the fields to return. Leave it out and you get every field — including fields added in the future, which is your call to make: name your fields if you want to be shielded from that.

  Only first-level fields can be named. A nested list such as attendees, tags or sectionItems is returned whole or not at all; attendees.name is not supported.

  On a paged response the selection applies to the entries in items; page, pageSize, total and hasMore are always returned. An unknown name is rejected with 400 rather than ignored.

  Selectable here: createdOn, directoryWide, event, isActive, name, url, webhookId.

  Example: createdOn,directoryWide

Response

• webhookIdstringrequired

  Id of the webhook.

• namestringrequired

  Display name of the webhook.

• eventstringrequired

  Event on which the webhook fires.

  Allowed values: summary.readymanualrecording.summarizedmeeting.summarized
• urlstringrequired

  Target URL that Sally POSTs the event to.

• isActivebooleanrequired

  Whether the webhook is actively firing.

• directoryWidebooleanrequired

  Whether the webhook fires directory-wide (for recordings of ALL users, admin/owner only) or personally (only for the creator's own recordings).

• createdOnstringrequired

  Creation timestamp (ISO-8601).

Status codes

• 200Success
• 400

  Invalid request (validation error).

• 401

  Missing or invalid bearer token.

• 403

  Forbidden (insufficient permissions).

• 404

  Resource not found or not accessible.

• 429

  Rate limit exceeded (per token/IP). Transcription uploads may also return code FUP_LIMIT_EXCEEDED or TOO_MANY_CONCURRENT_TRANSCRIPTIONS.

• 500

  Internal server error.

Request

cURL

curl -X POST "https://api.sally.io/v1.0/directories/$DIRECTORY_ID/webhooks/$WEBHOOK_ID/activate" \
  -H "Authorization: Bearer $SALLY_TOKEN"

JavaScript

const response = await fetch(`https://api.sally.io/v1.0/directories/${directoryId}/webhooks/${webhookId}/activate`, {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.SALLY_TOKEN}`,
  },
});
const data = await response.json();

Python

import os
import requests

response = requests.post(
    f"https://api.sally.io/v1.0/directories/{directory_id}/webhooks/{webhook_id}/activate",
    headers={"Authorization": f"Bearer {os.environ['SALLY_TOKEN']}"},
)
data = response.json()

Response example 200 OK

{
  "webhookId": "af39409b-ca90-443d-a5e8-47dfd97c518f",
  "name": "CRM sync",
  "event": "summary.ready",
  "url": "https://example.com/hooks/sally",
  "isActive": true,
  "directoryWide": true,
  "createdOn": "2026-09-24T09:30:00Z"
}

Deactivates a webhook

POST/v1.0/directories/{directoryId}/webhooks/{webhookId}/deactivate

Pauses a webhook without deleting it — it stays in the list but does not fire until it is reactivated. No request body. Same permissions as delete: a regular user can only change their own (personal) webhooks; admins/owners can change any webhook of the directory. Returns the updated webhook.

Path parameters

• directoryIdstringrequired

  Id of the directory (the Sally company account) the resource belongs to. The directories a token can address are listed by GET /v1.0/me/directories/memberships.

• webhookIdstringrequired

  Id of the webhook.

Query parameters

• fieldsstringoptional

  Comma-separated list of the fields to return. Leave it out and you get every field — including fields added in the future, which is your call to make: name your fields if you want to be shielded from that.

  Only first-level fields can be named. A nested list such as attendees, tags or sectionItems is returned whole or not at all; attendees.name is not supported.

  On a paged response the selection applies to the entries in items; page, pageSize, total and hasMore are always returned. An unknown name is rejected with 400 rather than ignored.

  Selectable here: createdOn, directoryWide, event, isActive, name, url, webhookId.

  Example: createdOn,directoryWide

Response

• webhookIdstringrequired

  Id of the webhook.

• namestringrequired

  Display name of the webhook.

• eventstringrequired

  Event on which the webhook fires.

  Allowed values: summary.readymanualrecording.summarizedmeeting.summarized
• urlstringrequired

  Target URL that Sally POSTs the event to.

• isActivebooleanrequired

  Whether the webhook is actively firing.

• directoryWidebooleanrequired

  Whether the webhook fires directory-wide (for recordings of ALL users, admin/owner only) or personally (only for the creator's own recordings).

• createdOnstringrequired

  Creation timestamp (ISO-8601).

Status codes

• 200Success
• 400

  Invalid request (validation error).

• 401

  Missing or invalid bearer token.

• 403

  Forbidden (insufficient permissions).

• 404

  Resource not found or not accessible.

• 429

  Rate limit exceeded (per token/IP). Transcription uploads may also return code FUP_LIMIT_EXCEEDED or TOO_MANY_CONCURRENT_TRANSCRIPTIONS.

• 500

  Internal server error.

Request

cURL

curl -X POST "https://api.sally.io/v1.0/directories/$DIRECTORY_ID/webhooks/$WEBHOOK_ID/deactivate" \
  -H "Authorization: Bearer $SALLY_TOKEN"

JavaScript

const response = await fetch(`https://api.sally.io/v1.0/directories/${directoryId}/webhooks/${webhookId}/deactivate`, {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.SALLY_TOKEN}`,
  },
});
const data = await response.json();

Python

import os
import requests

response = requests.post(
    f"https://api.sally.io/v1.0/directories/{directory_id}/webhooks/{webhook_id}/deactivate",
    headers={"Authorization": f"Bearer {os.environ['SALLY_TOKEN']}"},
)
data = response.json()

Response example 200 OK

{
  "webhookId": "af39409b-ca90-443d-a5e8-47dfd97c518f",
  "name": "CRM sync",
  "event": "summary.ready",
  "url": "https://example.com/hooks/sally",
  "isActive": true,
  "directoryWide": true,
  "createdOn": "2026-09-24T09:30:00Z"
}