Skip to main content

​
What are webhooks?

Webhooks are HTTP notifications that sends to your server when events happen — such as a message received, delivery status, or a template update. Instead of your system periodically polling the API, pushes events to you as they happen.
Webhooks require the ENTERPRISE role on your account. If your account does not have this role, webhook CRUD calls return 422. Contact support to enable it.

​
Webhook types

has two webhook types. What differs between them is the accepted events and how they are associated — each section covers its own specifics. The rest of this page applies to both types.

Channel webhooks

Receive the events of a specific channel (messages, delivery, connection).

Template webhooks

Receive WhatsApp template events, independent of any instance.

​
Payload formats

supports three payload formats:
payloadFormat applies to channel webhooks only. On template webhooks the format is always DEFAULT and the field is discarded.

​
Webhook authentication

You can configure how authenticates when calling your URL:

​
HMAC signing

To ensure requests received are genuinely from and have not been tampered with, enable HMAC signing by setting signing: true when creating the webhook. When enabled:
  • A 64-character hexadecimal secret is generated and returned only once on create/update.
  • Each request sent to your webhook includes a header with an HMAC-SHA256 signature computed over the payload.
  • You verify the signature on your server using the stored secret.
The secret is shown only in the create response or in an update with signing: true. Store it securely — it cannot be retrieved afterwards.