Speed-to-lead: a website form gets a call within a minute

A lead who fills in a form and gets a call within a minute closes far more often than one who waits until tomorrow. The voice_api.php endpoint receives the form details and launches an outbound call by the receptionist — with context (name, reason, source). The Receptionist → Call within a minute card shows your token and ready-made code snippets.

The request

POST https://vision.org.il/wa/voice_api.php
token=<lead_token>    ← from the Receptionist page (secret — keep it server-side)
phone=0501234567        ← required
name=Dana               ← optional
reason=first consult    ← optional (or: note)
source=landing:home     ← optional, for the sources report

JSON works too. The response:

{"ok":true,"mode":"queued"}       ← calling now
{"ok":true,"mode":"scheduled"}    ← quiet hours: scheduled for the next allowed window
{"ok":true,"mode":"duplicate"}    ← same number already queued in the last 30 minutes
{"ok":false,"error":"bad token"}  ← HTTP 403

PHP (on your server, after saving the lead)

<?php
$fields = [
    'token'  => 'YOUR_LEAD_TOKEN',
    'phone'  => $_POST['phone'] ?? '',
    'name'   => $_POST['name']  ?? '',
    'reason' => $_POST['subject'] ?? '',
    'source' => 'site:contact',
];
$ch = curl_init('https://vision.org.il/wa/voice_api.php');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => http_build_query($fields),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 8,
]);
$res = json_decode((string)curl_exec($ch), true);
curl_close($ch);
// $res['mode'] = queued | scheduled | duplicate

curl

curl -s -X POST https://vision.org.il/wa/voice_api.php \
  -d token=YOUR_LEAD_TOKEN -d phone=0501234567 -d name="Dana" \
  -d reason="first consult" -d source="landing"

Rules

• We call only people who left their number themselves. The consent is recorded in the consent log with the form as evidence.
• Up to 30 requests per hour per token — a hijacked form cannot drain your call quota. The token can be rotated with one click ("Regenerate token").
• The endpoint is open to CORS, so it can be called from the browser — but then the token is exposed in the page code. Server-side is better.
• Receptionist off or no provider? The response is secretary disabled and the lead is not lost — keep it on your side.