Attest a pre-call hook for PHI
POST /v1/pre-call-hooks/{hook_id}/attest-phi
| Property | Value |
|---|---|
| Operation | attest_pre_call_hook_phi |
| Group | Pre-call hooks |
| Scope | hooks:write |
| Route class | control |
| Idempotency | Idempotency-Key accepted: a retry with the same key replays the first answer |
| Audit | Audited dispatch.pre_call_hook.attest_phi (mutation) |
| Released in | 1.52.0 |
| Phase 0 host | Served (the hosted api pins 1.65.0) |
Records an owner's attestation that the hook's endpoint is the Organization's own system or covered by a BAA (1.52.0; call-lifecycle-hooks-and-events.md section 2.6), which a PHI-mode Organization requires before status: active, and answers the hook with phi_attested_at and phi_attested_by. Session only: the api refuses every API key with forbidden, and a Member who is not an owner with forbidden and the detail owner_required. A change of the URL clears the attestation. Audited as dispatch.pre_call_hook.attest_phi.
Request
Set VOCAL_API to the base URL of your API and VOCAL_API_KEY to an API key with the hooks:write scope (Authentication and keys). Replace each placeholder, such as agt_... or <name>, with your own value.
curl -X POST "$VOCAL_API/v1/pre-call-hooks/pch_.../attest-phi" \
-H "Authorization: Bearer $VOCAL_API_KEY" \
-H "Idempotency-Key: $(uuidgen)" \
-H "Content-Type: application/json" \
-d '{ "endpoint_covered": true }'const response = await fetch(`${process.env.VOCAL_API}/v1/pre-call-hooks/pch_.../attest-phi`, {
method: 'POST',
headers: {
Authorization: `Bearer ${process.env.VOCAL_API_KEY}`,
'Idempotency-Key': crypto.randomUUID(),
'Content-Type': 'application/json',
},
body: JSON.stringify({
"endpoint_covered": true
}),
});
console.log(response.status, await response.text());import os
import uuid
import requests
response = requests.post(
f"{os.environ['VOCAL_API']}/v1/pre-call-hooks/pch_.../attest-phi",
headers={
"Authorization": f"Bearer {os.environ['VOCAL_API_KEY']}",
"Idempotency-Key": str(uuid.uuid4()),
},
json={
"endpoint_covered": True,
},
)
print(response.status_code, response.text)Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
hook_id | path | PreCallHookId | yes | The id of a pre-call hook: pch_ and the row's UUIDv7 in 26 Crockford base32 characters. Opaque and safe to log. |
idempotency-key | header | string | no | A client-chosen key, kept 24 hours per Organization, environment and route. A replay returns the stored response. |
Request body
Content type application/json, required: PreCallHookPhiAttestationRequest.
| Field | Type | Required | Description |
|---|---|---|---|
endpoint_covered | true | yes | The owner's statement that the endpoint is the Organization's own system or covered by a BAA. |
Responses
| Status | Content type | Shape | Error codes |
|---|---|---|---|
200 | application/json | PreCallHook | |
400 | application/json | ErrorEnvelope | invalid_request |
401 | application/json | ErrorEnvelope | unauthenticated |
403 | application/json | ErrorEnvelope | forbidden, org_suspended |
404 | application/json | ErrorEnvelope | not_found |
409 | application/json | ErrorEnvelope | idempotency_in_progress, idempotency_key_reused |
429 | application/json | ErrorEnvelope | rate_limited |
500 | application/json | ErrorEnvelope | internal_error |
Fields of the 200 answer
The shape is PreCallHook.
| Field | Type | Required | Description |
|---|---|---|---|
allowed_agent_ids | array of AgentId | yes | Agents besides the routed one whose published versions a response may select; empty allows only versions of the routed Agent. |
consecutive_failures | integer | yes | |
created_at | Timestamp | yes | |
default | PreCallHookDefault or null | yes | |
directions | array of PreCallHookDirection | yes | |
id | PreCallHookId | yes | |
object | "pre_call_hook" | yes | |
on_failure | PreCallHookOnFailure | yes | |
phi_attested_at | Timestamp or null | yes | When an owner attested the endpoint for PHI; null before. |
phi_attested_by | MemberId or null | yes | |
previous_secret_expires_at | Timestamp or null | yes | |
previous_secret_hint | string or null | yes | |
revision | integer | yes | |
scope | PreCallHookScope | yes | |
secret_hint | string | yes | The last four characters of the current secret. |
status | PreCallHookStatus | yes | |
timeout_ms | integer or null | yes | The deadline of a request; null for the default of each direction. |
updated_at | Timestamp | yes | |
url | string | yes | The endpoint. |