> ## Documentation Index
> Fetch the complete documentation index at: https://docs.heymilo.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API & Integration FAQ

> Answers to common questions from teams building on the HeyMilo API: webhook signing, interview results, and candidate experience details that show up in API data.

Questions we hear most from developers integrating with HeyMilo. For endpoint details, see the [v2 API Overview](/api-reference/overview). For webhook payloads and signing, see [Webhooks](/api-reference/webhooks/webhook-documentation).

Don't see your question? Email [support@heymilo.ai](mailto:support@heymilo.ai) and we'll add it here.

## Webhooks

**How do I verify that a webhook came from HeyMilo?**
Webhooks created through the v2 or v4 endpoints are signed with HMAC-SHA256. The create response includes a `signing_secret` (it starts with `whsec_`). Each delivery carries an `X-HeyMilo-Signature` header with a timestamp and signature; recompute the signature with your secret and compare. See [Verifying Webhook Signatures](/api-reference/webhooks/webhook-documentation#verifying-webhook-signatures).

**Can I retrieve or rotate a webhook's signing secret?**
No. The secret is returned once, in the create response, and never appears in get or list responses. If you lose it, delete the webhook and register a new one to get a fresh secret. Each webhook has its own secret.

**I registered a webhook before signing existed. Does it have a secret?**
No. Older registrations, and any created through the legacy `POST /api/webhook/create` endpoint, are delivered unsigned. Delete the webhook and re-create it through `POST /api/v2/webhooks` or `POST /api/v4/webhooks` to start receiving signed deliveries.

**What is the webhook signing scheme?**
Deliveries include `X-HeyMilo-Signature` (`t=<unix_seconds>,v1=<hex_digest>`). HeyMilo signs `"{timestamp}.{raw_request_body}"` with HMAC-SHA256 using your `signing_secret`. Verify against the raw body bytes before JSON parsing. The timestamp is part of the signed string so you can reject replays; HeyMilo doesn't enforce a max age on its side, so pick a tolerance that fits your app (five minutes is common). Deduplicate retries using payload fields or `X-HeyMilo-Delivery` where it identifies a single event. Full steps and code samples: [Verifying Webhook Signatures](/api-reference/webhooks/webhook-documentation#verifying-webhook-signatures).

**How should I authenticate webhook requests?**
Use the signing secret and HMAC verification described in the webhook docs. That's the supported way to confirm a delivery came from HeyMilo. If you need something beyond that (for example network-level restrictions), contact [support@heymilo.ai](mailto:support@heymilo.ai).

**When does the `report_available` webhook fire?**
In the usual flow, events arrive in order: `interview_started`, then `interview_completed`, then `report_available` after AI analysis finishes. That analysis step can take from a few seconds to a few minutes after the interview is marked completed. See [Event lifecycle](/api-reference/webhooks/webhook-documentation#event-lifecycle) and the `report_available` payload section in [Webhooks](/api-reference/webhooks/webhook-documentation).

## Candidates & ingestion

**Can I ingest candidates through the API?**
Yes. The v2 API exposes candidate ingest on a posting, for example `POST /api/v2/postings/{posting_id}/candidates` (sync), async variants, and bulk routes. See [v2 API Overview — Candidates & ingestion](/api-reference/overview#candidates--ingestion) and the OpenAPI reference under **v2 API Reference**.

**Is the Ingestion Gateway the same as the ingest API?**
No. **Ingestion Gateway** is the in-app bulk flow (CSV and resume uploads) under **Interviewer → Integrations → Inbound**. **Ingestion API** is programmatic ingest using your API key and posting ID. Many teams use both: gateway for one-off batches, API for automation. See [Inviting Candidates — Bulk ingestion](/integrations/without-ats/inviting-candidates#bulk-ingestion-csv--resumes).

## Email & outreach

**Can I set Reply-To on workspace, posting, template, or sender email?**
No. HeyMilo doesn't expose Reply-To at those levels today. **Sender Domains** and **Email Templates** control the **From** address candidates see on outbound mail (after you verify your domain). They don't route **replies** to your recruiters.

**Where do candidate replies to HeyMilo emails go?**
Replies to typical HeyMilo-sent candidate mail go to **[support@heymilo.ai](mailto:support@heymilo.ai)**, not to your team's inboxes. If your template tells candidates to "reply to this email," your recruiters won't see those replies unless HeyMilo support handles them separately. Use a clear call to action you control (interview link, a mailbox you monitor) or talk to your CS Manager or [support@heymilo.ai](mailto:support@heymilo.ai) about workflow. See [Sender Domains — From vs replies](/deep-dive/outreach/sender-domains#from-address-vs-replies).

## Interviews & results

**The transcript shows "Interviewer Sara" but I set a different `interviewer_name`. Why?**
"Sara" in the transcript is a fixed display label. It isn't read from your posting or step configuration, and the AI doesn't use it. The AI introduces itself with the `interviewer_name` you set. If you rename your interviewer, update `interviewer_name`; the change applies to future interviews only, and past transcripts are unchanged.

**Will the AI introduce itself as "Sara" if I change `interviewer_name`?**
No. The agent uses your configured `interviewer_name` in the conversation. "Sara" on the transcript is only a display label on that view.

## Candidate experience

**What does the "Don't Interrupt Me" button do during a voice interview?**
It sends a mute or unmute signal to the voice provider, pausing or resuming the interviewer's speech. It doesn't change how the AI handles interruptions or turn-taking, so if the interviewer wasn't speaking when the candidate clicked it, nothing visible happens. It can't be configured or hidden through workspace or posting settings.