Webhooks & endpoints

• GET /api/health — liveness and database check. Returns no secrets.
• GET|POST /api/webhooks/whatsapp/<workspace-key> — Meta verification and events (signature verified with your app secret).
• POST /api/webhooks/telephony/<workspace-key> — Twilio or generic signed call events.
• POST /api/webhooks/razorpay — payment events (signature verified).
• POST /api/cron/tick — drains the job queue; requires Authorization: Bearer $CRON_SECRET.

See docs/API.md in the source repository for full request and response formats.