Event API

Lead & booking events

Receive captured call details as JSON. A booking event replaces the lead event for the same push.

Event types

Subscription value	Receives
`lead`	A call captured what the caller wants, and no appointment was booked. The default when event is left out of a subscribe call.
`booking`	A call ended with a time agreed. Carries the appointment; never carries urgency or booked.
`all`	Receives both lead and booking pushes. Meant for a single webhook target that wants everything, the way Pongg's own Integrations page subscribes a pasted Catch Hook URL.

Use only lead, booking or all. The current subscription endpoint does not reject an unknown event string, but that string will not match lead/booking fan-out. There is no general call.completed event in this API.

Lead payload

JSON

{
  "id": "5b1c9e3a-2f0d-4b7a-9c8e-1a2b3c4d5e6f",
  "call_id": "call_2f7a1c9e8b3d",
  "source": "Pongg (phone)",
  "provider": "",
  "occurred_at": "2026-09-21T15:04:05+00:00",
  "contact": {
    "full_name": "Jane Sample",
    "first_name": "Jane",
    "last_name": "Sample",
    "phone": "+15555550123",
    "email": "jane@example.com",
    "address": "12 Oak Street"
  },
  "job_type": "Estimate",
  "summary": "Wants a quote for a new roof",
  "urgency": "This week",
  "booked": false,
  "appointment": null,
  "event": "lead"
}

A lead event has urgency, booked:false and appointment:null. Summary and urgency are free-form and can be empty.

Booking payload

JSON

{
  "id": "b7e2a1d4-6c3f-4a9b-8e2d-5f1c9a3b7e4d",
  "call_id": "call_9a3f7c1e2b8d",
  "source": "Pongg (phone)",
  "provider": "",
  "occurred_at": "2026-09-21T15:04:05+00:00",
  "contact": {
    "full_name": "Jane Sample",
    "first_name": "Jane",
    "last_name": "Sample",
    "phone": "+15555550123",
    "email": "jane@example.com",
    "address": "12 Oak Street"
  },
  "job_type": "Roof inspection",
  "summary": "Booked an inspection for the leak over the garage",
  "appointment": {
    "timezone": "America/Chicago",
    "start": "2026-09-23T14:00:00+00:00",
    "end": null,
    "slot_text": "Wednesday 9am",
    "job_type": "Roof inspection",
    "address": "12 Oak Street",
    "status": "scheduled"
  },
  "event": "booking"
}

Booking events omit urgency and booked. appointment.start and appointment.end may be null; slot_text preserves the requested time in words. requested means the business still needs to confirm. scheduled records the canonical scheduling status and should still be checked against the intended provider when verifying a live write.

Shared and optional fields

Field	Meaning
id	Stable event identifier. Deduplicate on this, not on the sender’s phone number.
call_id	Originating call identifier; it is not a public call-history URL.
source / provider	Source label and connected-provider label; provider is currently empty in event fan-out.
occurred_at	Time the event payload was built, in UTC ISO 8601; not the call start time.
contact	Captured name, phone, email and address. Uncaptured fields may be empty strings.
contact.postal_code / location	Optional additive fields when present. location contains id and name.
job_type / summary	Captured service type and free-form summary. Neither is a full transcript.

Accept compatible additive fields. There are no dedicated transcript, recording URL or payment fields in these events. Avoid inferring identity from imperfectly captured names.

Delivery behavior

Pongg POSTs JSON to each matching subscription. Each fan-out delivery is best-effort: one attempt, no durable retry queue and no public replay endpoint. A failed or refused receiver does not fail the CRM delivery. Persist and deduplicate accepted events in your own workflow.

The current sender counts HTTP statuses below 400 as delivered. Return 200 or 204 deliberately; redirects are not a receiver-authentication mechanism. A subscription acknowledgement does not test target reachability. Delivery is blocked for addresses resolving to private, loopback, link-local or metadata ranges.

Signature limitations

HTTP

Content-Type: application/json
X-CenterCrest-Signature: sha256=<HMAC-SHA256 of the exact body>

Use the minimum receiver permissions and validate event data before taking action. If your workflow requires independently verifiable delivery and durable redelivery, discuss those requirements with your Success Team before launch.

Machine-readable contract

Download the event API OpenAPI document or synthetic event fixtures.