Convert CDR files
from your own application

Send your secret key as a bearer token. That is the only header required.

Create keys in your dashboard. Each key has:

• pk_live_… — a public identifier. Safe to put in a log or a support ticket.
• sk_live_… — the secret. Shown once, at creation. We store only a hash, so we cannot recover it for you — roll the key instead.
• whsec_… — signs the webhooks we send you.

Sandbox keys use sk_test_ and run real conversions against your sandbox allowance.

Never put a key in a query string — we reject it there on purpose. Query strings end up in access logs, proxy logs and referrer headers.

Send the file as multipart form data, or give us a URL to fetch it from.

Either means send exactly one of file or file_url. Returns 202 Accepted with the conversion object.

Set a callback URL on your key and we POST to it as the job moves. Events: conversion.processing, conversion.completed, conversion.failed.

{
  "event":   "conversion.completed",
  "created": 1727500000,
  "data": {
    "id":           "cv_8f4a2b1c9d0e1f23",
    "status":       "completed",
    "external_id":  "order-4471",
    "download_url": "https://...",
    "download_url_expires_at": "2026-09-29T10:00:00+00:00"
  }
}

Verify the signature

Every delivery carries an X-AsanConvert-Signature header. Check it before you trust the body — your endpoint is a public URL, and anyone who learns it could otherwise post to it.

X-AsanConvert-Signature: t=1727500000,v1=5f8a...c21

# The signed string is "{timestamp}.{raw request body}"
# PHP
[$t, $v1] = sscanf($header, "t=%d,v1=%s");

$expected = hash_hmac('sha256', $t . '.' . $rawBody, $webhookSecret);

// Reject anything older than 5 minutes, then compare in constant time
if (abs(time() - $t) > 300)                  return 401;
if (! hash_equals($expected, $v1))        return 401;

The timestamp is inside the signed string, so an old body cannot be replayed with a fresh timestamp. Use the raw request body — re-encoding the JSON changes the bytes and the signature will not match.

Retries

Answer with any 2xx and we consider it delivered. Anything else is retried with a growing delay — 10 seconds, 1 minute, 5 minutes, 30 minutes, then 2 hours. Every attempt is listed in your dashboard. We do not follow redirects, so point us at the final URL.

Every response carries your current standing:

Going over returns 429 with a Retry-After header. Wait that many seconds.

Quota counts conversions, not requests. Polling the status of a job as often as you like costs nothing. A retry does count, because it runs the file again.

Every error has the same shape. Branch on error.code, which is stable — the message may be reworded.

{
  "error": {
    "code":    "format_conversions_not_in_plan",
    "message": "Format conversion is not included in your plan.",
    "doc_url": "https://asanconvert.com/api-for-developers#errors"
  }
}