Call the Edesy number masking REST API from Python with plain HTTP: create a masked session, place a click-to-call and verify signed event webhooks. There is no Python SDK to install; any HTTP client works.
Number masking at a glance
From API key to first masked call
Sign up at masking.edesy.in, complete KYC and create an API key (it starts with vp_). The full key is shown once, so store it in an environment variable.
Enroll a number from your Edesy account for masking. One number can serve many sessions at once.
POST /v1/masking/sessions with party_a, party_b and your reference, using requests (or httpx). Give the returned virtual_number to both parties.
Set your endpoint with PUT /v1/masking/event-webhook and verify the X-Edesy-Signature header before trusting an event.
Create a masked session and verify an event webhook. Replace the numbers with real 10-digit Indian mobiles.
# Python 3: plain HTTP with requests. No SDK to install.
import hashlib, hmac, os
import requests
from flask import Flask, request, abort
API = "https://voice-api.edesy.in/v1"
HEADERS = {
"Authorization": f"Bearer {os.environ['EDESY_API_KEY']}", # vp_...
"Content-Type": "application/json",
}
# 1. Create a two-way masked session
resp = requests.post(f"{API}/masking/sessions", headers=HEADERS, json={
"party_a": "9876543210",
"party_b": "9123456789",
"reference": "ORD-4821",
"expiry_minutes": 60,
}, timeout=10)
resp.raise_for_status()
print(resp.json()["data"]["virtual_number"]) # share with both parties
# 2. Receive and verify event webhooks (X-Edesy-Signature: sha256=<hex>)
app = Flask(__name__)
@app.post("/edesy/events")
def edesy_events():
body = request.get_data() # raw bytes, before JSON parsing
expected = "sha256=" + hmac.new(
os.environ["EDESY_WEBHOOK_SECRET"].encode(), body, hashlib.sha256
).hexdigest()
if not hmac.compare_digest(request.headers.get("X-Edesy-Signature", ""), expected):
abort(401)
event = request.get_json()
print(event["event"], event.get("reference"), event.get("duration_sec"))
return "", 200JSON in, JSON out. Use requests (or httpx) or any HTTP client you already have.
Send Authorization: Bearer vp_... on every request. Missing or invalid keys get 401.
Events are signed with HMAC-SHA256 over the raw body, sent as sha256=<hex>. Verify with hmac.new and hmac.compare_digest.
Errors come back as JSON with a code and message, for example insufficient_balance (402) or rate_limited (429).
Rs 1.50/min in 60-second pulses, 1-minute minimum, plus number rental (Rs 499/month mobile, Rs 449/month landline). Prices exclude 18% GST. New accounts get a Rs 20 welcome credit; no card needed to sign up.
Get started on the self-serve portal. Rs 1.50 per minute plus number rental. New accounts get a Rs 20 welcome credit; no card needed to sign up.