Webhook subscription keeps working even after removing all permissions

1. That's weird and it should not be working if the app does not have any app permission. I will test to verify this later.

2. Out of my head, I don't have the reason behind the requirement of the CallControl permission for only receiving the telephony session events. But unfortunately, it is the current requirement and I know that it causes trouble to app developers to meet the app graduation requirement for such a use case. For now, you need to implement some extra features to exercise the CallControl permission. Here is a simple one in Node JS.

// Within your Webhook callback function
...
hangupCall(body.telephonySessionId)
...


async function hangupCall(telSesId){
    try{
      await platform.delete(`/restapi/v1.0/account/~/telephony/sessions/${telSesId}`)
    }catch(e){
      console.log(e.message)
    }
}

Then make a few incoming calls to the phone number of a user extension who is authenticated to use your app.