Webhook subscription keeps working even after removing all permissions

Question

question

Nikolai Chashchin asked Sep 30, '22 Nikolai Chashchin commented Oct 14, '22

Webhook subscription keeps working even after removing all permissions

Hi Community,

I have questions regarding app graduation. We have a app that gets telephony session notifcations through webhooks. We use just one filter: /restapi/v1.0/account/~/telephony/sessions

1. For testing purposes we removed all permissions from the app, but we still be able to subscribe/unsubscribe to/from the notifications and receive them. How is this possible? What is the reason for giving 'WebhookSubsciption' and 'CallControl' permissions to the app then?

2. We have similar situation: https://community.ringcentral.com/questions/109339/exercise-all-requested-permissions-not-met-even-th.html. We need to detect call states such as call start, hold, unhold and call end. From the response in above thread I understood that to pass graduation we only need to subscribe/unsubscribe several times and we only need 'WebhookSubscrition' permission set for the application. So why do we need then 'CallControl' permission at all?

Best,

Nikolai Chashchin

webhooks permissions

1 |3000

Attachments: Up to 8 attachments (including images) can be used with a maximum of 1.0 MiB each and 10.0 MiB total.

Using the RingCentral Phone for Desktop, you can dial or receive test calls, send and receive test SMS or Fax messages in your sandbox environment.

Download RingCentral Phone for Desktop:

Tip: switch to the "sandbox mode" before logging in the app:

On MacOS: press "fn + command + f2" keys
On Windows: press "Ctrl + F2" keys

Answer 1 · 2022-09-30T16:02:47Z

Phong Vu answered Sep 30, '22 Nikolai Chashchin commented Oct 14, '22

1. That's weird and it should not be working if the app does not have any app permission. I will test to verify this later.

2. Out of my head, I don't have the reason behind the requirement of the CallControl permission for only receiving the telephony session events. But unfortunately, it is the current requirement and I know that it causes trouble to app developers to meet the app graduation requirement for such a use case. For now, you need to implement some extra features to exercise the CallControl permission. Here is a simple one in Node JS.

// Within your Webhook callback function
...
hangupCall(body.telephonySessionId)
...


async function hangupCall(telSesId){
    try{
      await platform.delete(`/restapi/v1.0/account/~/telephony/sessions/${telSesId}`)
    }catch(e){
      console.log(e.message)
    }
}

Then make a few incoming calls to the phone number of a user extension who is authenticated to use your app.

1

1 |3000

Attachments: Up to 8 attachments (including images) can be used with a maximum of 1.0 MiB each and 10.0 MiB total.

Nikolai Chashchin commented · Oct 14, 2022 at 07:31 AM

Thank you!

0 ·

question