Your CRM stays the source. DialBreeze handles the calls.

The signed disposition webhook.

An admin on a Jetstream seat sets up and reads the export, and delivery covers the workspace's dispositions, including Breeze callers, whenever the workspace has at least one Jetstream seat. That admin sets one endpoint and a shared secret in workspace settings. When an operator saves an outcome, DialBreeze POSTs the event, signs it with HMAC-SHA256 over the timestamp and body, and attempts delivery up to three times, with a five-second timeout per attempt.

• Signature header X-DialBreeze-Signature
• Timestamp header for receiver-side freshness checks
• Best-effort delivery audit (not downstream CRM write proof)

Verify the exact raw request body before parsing JSON or acting on it. A timestamp window limits stale requests but does not deduplicate retries: design duplicate detection and record downstream failures separately. A provider catch URL may acknowledge a request before later steps finish. Use a verification gateway if your automation cannot validate the raw body and headers.

import crypto from "node:crypto"; // Receiver sketch. Also deduplicate events and audit downstream results. export function verify(rawBody, timestamp, signature, secret) {   if (!/^\d{10}$/.test(timestamp ?? "")) return false;   if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;   if (!/^sha256=[a-f0-9]{64}$/i.test(signature ?? "")) return false;   const expected = crypto.createHmac("sha256", secret)     .update(`${timestamp}|${rawBody}`).digest();   const given = Buffer.from(signature.slice(7), "hex");   return crypto.timingSafeEqual(given, expected); }