# Connect Sylaris OS

> Send payments, provider decisions, shipments and refills from Sylaris OS to Kalman over a signed webhook, then check that they arrived.

Updated 2026-11-10 · Sources · https://kalmananalytics.com/support/connect-sylaris-os/

Your website tag sees the visit and the intake. Sylaris OS sees what happens next: payments, provider decisions, shipments and refills. Connecting Sylaris OS sends those server events to Kalman, so your reports and ad platforms count real outcomes.

## Pick the right connection

- **Sylaris OS source** (this article): Sylaris sends events in Kalman's own format and signs each one.
- **Webhook catcher**: Sylaris sends its usual order webhook as it is, and you map the fields in Kalman. See [Webhook catchers](/support/webhook-catchers/).

## Before you start

- You need to be an owner or admin of the workspace.
- The workspace needs an active plan. A webhook sent to a preview workspace gets a "not found" answer.
- Install the tag first ([Install the tag](/support/install-the-tag/)), so server events can join the site visit that led to them.

## Set it up

1. Open **Integrations**. Under **Telehealth platforms**, find **Sylaris OS** and click **Connect**.
2. The new source opens. In the **Endpoint** panel, copy the **Webhook URL**.
3. Under **Signing secret**, click **Reveal** and copy the secret.
4. In Sylaris OS, paste the URL and the secret into the clinic's Kalman settings.

Sylaris signs each request with the header `X-Kalman-Signature: t={unix},v1={hex}`. The value is an HMAC-SHA256 of `{t}.{raw body}`. Kalman rejects requests more than 5 minutes old. **Rotate secret** makes a new secret, and the old one stops working at once, so update Sylaris right away.

## Which events arrive

| Event                                                                               | When                                 |
| ----------------------------------------------------------------------------------- | ------------------------------------ |
| `purchase`                                                                          | Payment captured                     |
| `provider_approved` / `provider_declined`                                           | The clinician decides                |
| `order_shipped`                                                                     | The pharmacy ships                   |
| `refill_purchased`                                                                  | A renewal is paid                    |
| `subscription_canceled`                                                             | The patient cancels                  |
| `refund_issued`                                                                     | A refund is processed                |
| `lead`, `intake_started`, `intake_completed`, `checkout_started`, `account_created` | Optional server copies of site steps |

Kalman receives and stores every event in this table, but it doesn't send all of them to your ad platforms. **Provider approved** and **Provider declined** are available but off: they go to Meta, Google or another channel only after you map them on that channel's page and acknowledge that you're sending a provider's decision. Purchases and refills are mapped by default.

A custom name works too. It must start with a letter, use only letters, numbers and underscores, and be at most 40 characters. Kalman drops a name that contains a sensitive term.

Useful fields on each event:

- `order_ref`: Kalman counts purchases, refills, approvals, declines, shipments and cancellations once per order. Give each refill its own `order_ref`. Other events are de-duplicated by `event_id`.
- `product_sku`: a non-descriptive ID such as `plan-a` that matches a SKU on the Products page ([Products and aliases](/support/products-and-aliases/)). If a purchase, refill or checkout has no `value`, Kalman uses the product's price.
- `kl_id`: the visitor's `_kl_id` cookie, captured at checkout. It joins the event to the site visit and the ad click.
- `email`, `phone`, `external_id`: Kalman hashes these on arrival.
- `ad_consent`: `false` stops ad sharing for that person.

## Test it

1. Place a test order in Sylaris, then move it through paid, approved and shipped.
2. On the source page, **Recent deliveries** lists each delivery and its status:
    - **processed**: the event was recorded.
    - **ignored**: nothing could be recorded, for example because the event name was dropped. The Detail column shows `no_mappable_events`.
    - **failed**: the Detail column says why, for example `bad_signature` or `malformed_json`.
3. Open **Event log** to see the recorded events.

To pause the source, set **Status** to **Disabled (reject deliveries)** and click **Save**.

## Privacy

- Kalman stores raw webhook bodies encrypted and deletes them after 30 days. Recent deliveries shows only a status, never the payload.
- Email, phone and patient ID are normalized and SHA-256 hashed on arrival. Only the hashes are kept.
- Never send question text, answers, conditions, medications, product names or free text.

**What Kalman never sends:** ad platforms never receive your product SKUs or names, intake step details, or plain-text emails and phones. Outbound events are built from a short allowlist of fields.

Still stuck? Log in and open a request: https://app.kalmananalytics.com/support