Callback Security Rules

Asynchronous tasks can send terminal-state notifications to webhook_url. The URL must be a publicly accessible HTTPS address.

URL validation

Rule	Description
Protocol	HTTPS is required.
Disallowed addresses	localhost, 127.0.0.1, private addresses, loopback addresses, and internal domains.
Data format	The server sends a compact terminal-state notification as POST JSON. It does not include the complete task result.
Failure handling	The callback retry strategy depends on the final engineering implementation.

Callback request body

When a task reaches a terminal state, the server sends the following compact notification to webhook_url.

{
  "TaskID": "<task_id>",
  "TenantID": "<tenant_id>",
  "Status": "SUCCESS",
  "CallbackURL": "https://example.com/webhook"
}

Field	Type	Description
`TaskID`	string	Task ID used to query the complete result.
`TenantID`	string	Tenant ID.
`Status`	string	Terminal task state; possible values are `SUCCESS` and `FAILED`.
`CallbackURL`	string	The `webhook_url` used for this callback; this is the callback address, not a result URL.

The callback body uses PascalCase names, unlike the snake_case fields in the /v1 API. After receiving a notification, use TaskID with GET /v1/audio/tasks/{task_id} to retrieve the complete task result.