Ahoi API: CallSid Prefix Reuse Issue

Evidence Report - Generated January 5, 2026

Executive Summary

We have discovered that the Ahoi API reuses complete CallSid prefixes (the ID{uuid} portion) across completely different, unrelated calls. This is not a case of "similar first few characters" - these are byte-for-byte identical 34-character strings being recycled for new calls hours or days later.

    Impact:
    This breaks any system that relies on CallSid as a unique identifier to correlate webhook events, match call records, or track call state across multiple callbacks.
  

Reused Prefixes Found

Calls Affected

23+

Max Days Between Reuse

What Is Being Reused

A typical Ahoi CallSid looks like this:

IDe024b8c0e92d4f78b70b80ea91d1246e

This is a 34-character string consisting of:

ID - 2-character prefix
e024b8c0e92d4f78b70b80ea91d1246e - 32-character hex string (appears to be a UUID without hyphens)

We are observing this entire 34-character string being reused verbatim for completely different calls.

Expected Behavior

Each call receives a unique CallSid that is never reused, allowing it to serve as a reliable primary key for call correlation.

Actual Behavior

The same CallSid prefix is assigned to multiple unrelated calls from different callers to different destinations, hours or days apart.

Evidence: Documented Cases

Case 1: Most Severe - 5 Reuses Over 8 Days

IDe024b8c0e92d4f78b70b80ea91d1246e

#	Date/Time (UTC)	From Number	To Number	Duration
1	2025-12-28 20:09:05	+1 201-400-2196	877-407-0034	9 sec
2	2025-12-30 00:02:49	+1 209-628-9072	877-312-0629	163 sec
3	2026-01-02 19:36:25	+1 270-313-1942	877-312-0778	535 sec
4	2026-01-02 22:52:11	+1 509-628-7244	877-407-0083	312 sec
5	2026-01-05 19:41:03	+1 830-688-2461	877-407-0083	372 sec

Key observation: 5 completely different callers, calling different destination numbers, over an 8-day period - all assigned the identical CallSid prefix.

Case 2: Longest Gap - 23+ Days Apart

IDf719aa6bf43b4acf845c7ae6c8df8220

#	Date/Time (UTC)	From Number	To Number	Duration
1	2025-12-11 01:07:02	+1 201-400-2196	973-201-3071	47 sec
2	2025-12-26 17:38:45	+1 201-400-2196	877-407-0250	10 sec
3	2026-01-02 20:43:59	+1 830-299-5030	877-312-0933	62 sec
4	2026-01-03 17:02:01	+1 419-460-3244	877-407-0196	85 sec

Key observation: The same prefix was used on Dec 11, then again on Dec 26 (15 days later), and twice more in early January.

Case 3: Same Day Reuse - 1.5 Hours Apart

ID5945e613e01a458dbc9e25e13d42d15a

#	Date/Time (UTC)	From Number	To Number	Duration
1	2026-01-02 20:30:10	+1 417-300-2537	877-407-0034	943 sec
2	2026-01-02 21:52:41	+1 503-995-1151	877-312-0933	833 sec

Key observation: Two different callers, different destinations, only 82 minutes apart - same CallSid prefix.

Case 4: Today's Example (Jan 5, 2026)

IDc733868cfa6a4a61b948e23a57538cfb

#	Date/Time (UTC)	From Number	To Number	Duration
1	2026-01-05 12:58:41	+1 757-581-5394	877-407-0034	201 sec
2	2026-01-05 17:30:15	+1 904-518-1381	877-312-0629	0 sec

Key observation: This reuse happened today, demonstrating the issue is ongoing.

Complete List of Reused Prefixes

CallSid Prefix	Times Reused	Time Span
IDe024b8c0e92d4f78b70b80ea91d1246e	5	8 days
IDf719aa6bf43b4acf845c7ae6c8df8220	4	23 days
ID0079817a5704478bb7033f113ac604d5	2	10 hours
ID019aa03041aa468e918bb30658d18298	2	10 hours
ID207b8f9862d94e7fb299fb50a0945a69	2	10 hours
ID5945e613e01a458dbc9e25e13d42d15a	2	1.5 hours
ID6541a85c66b04b92b22d58c0248484a4	2	6 hours
ID67cb7a5276e94db987330c5e853a45fd	2	9.5 hours
ID695b16406f8a42ff924619e9950c5fff	2	3 hours
ID85381b6abd8447f9bfc767a43875581d	2	8 days
ID8667e12714e64ea59a3cce07e14356a7	2	1.5 hours
ID9c157907c3f94631b323fdb3267ca8c8	2	9 hours
IDa0f6ee37e295476cb1b5bdf089d95cff	2	2 hours
IDc733868cfa6a4a61b948e23a57538cfb	2	4.5 hours
IDcd8138f5bd804c5c9503beba26a50070	2	9.5 hours
IDce740a21f91b4d31baf510780c99b7b5	2	2.5 hours
IDd44c7c9271a542af89bce1fdf5822fbc	2	12 hours
IDd67b73641f0844fb90deb230ff724552	2	6 hours
IDf231c6d384ee45518dc2950e2083b7b2	2	8 hours

Technical Impact

This behavior causes problems for any system that:

Uses CallSid as a unique identifier or primary key
Correlates incoming call webhooks with dial status callbacks
Maintains call state across multiple webhook events
Looks up call records by CallSid to update status, duration, or recording URLs

    Our Workaround:
    We've implemented a workaround that detects stale prefix reuse and appends a timestamp suffix to create unique identifiers. However, this is a band-aid solution that adds complexity and potential failure points.
  