Skip to content
DashboardGet API key

Get the project webhook

View .md
GET

One webhook for the whole project and every event, message.*, conversation.new and call.* included. Payloads name addresses (from, to) and the transport (type), never a sender id; see WebhookPayloadV2.

Alongside /v1 webhooks. Configuring this webhook is the opt-in. From then on each event is delivered here in addition to any /v1 sender webhook or /v1 project webhook subscribed to it, as independent deliveries with different event ids. Nothing is deduplicated. senderWebhooks lists the /v1 sender webhooks still on; switch them off with disableSenderWebhooks on PUT once this one is verified.

It does not share storage with /v1/invitations/webhook.

Authorization

  • Authorizationheaderrequired

    Bearer YOUR_API_KEY. Create a key in the dashboard.

Responses

200The webhook (null when none), and the /v1 sender webhooks still on.
  • webhookobjectrequirednullable

    The one webhook for everything in the project. Stored apart from the /v1 project webhook (/v1/invitations/webhook); neither API reads or writes the other's.

    5 properties
    • urlstring<uri>required
    • eventsstring[]required

      Any event in WebhookEvent, including message.*, conversation.new and call.*.

      One ofmessage.queuedmessage.sentmessage.deliveredmessage.readmessage.failedmessage.inboundmessage.unsupportedbroadcast.status_changedconversation.newcontact.identity_linkedtemplate.status_changedinvitation.status_changedcall.initiatedcall.answeredcall.completedcall.faileddomain.verifieddomain.failed
    • activebooleanrequired
    • signatureVersionstringrequired

      Which X-Zavu-Signature scheme this receiver is sent. The header is t=<unix seconds> followed by the signatures.

      • v1: v1=HMAC_SHA256(secret, body).
      • v2: v2=HMAC_SHA256(secret, "{t}.{body}"). The current scheme, and the default for a new /v2 webhook. It signs the timestamp together with the body.
      • v1+v2: both signatures, sharing one t. The migration setting: a receiver reading either one works.

      Moving straight between v1 and v2, in either direction, returns 400. Set v1+v2 first. See https://www.zavu.dev/docs/guides/receiving-messages/signature-migration

      One ofv1v1+v2v2
    • secretstring

      Returned only by PUT /v2/webhook when it creates the webhook, and by POST /v2/webhook/secret.

  • senderWebhooksobject[]required
    3 properties
    • addressstringrequirednullable

      The sender's first address; null for a sender with no connected transport.

    • urlstring<uri>required
    • v1SenderIdstringrequired

      Read-only; the sender to change on /v1.

401Unauthorized.
  • codestringrequired
  • messagestringrequired
  • detailsobject

    Machine-readable context. Keys that mean the same thing everywhere: - errors: present on every 400 invalid_request for an invalid body or query parameter, [{path, message, ...}], path naming the field (["to"], ["contacts", 2, "recipient"], ["limit"]). - recommendation: one sentence saying what to do next. - dashboardUrl: the dashboard screen that fixes it. - connect: on 409 no_channel, the channels this project can connect to reach the recipient, each {type, request, note, available, dashboardUrl?}; request is the exact call (POST /v2/channels with its body, or POST /v2/numbers), or null for a channel connected from the dashboard (WhatsApp, Instagram, Messenger). available: false says why in note (one-way SMS closed until business verification is approved). - address / from: the address the error is about, under the name the request used for it.

    1 properties
    • errorsobject[]
      3 properties
      • pathobject[]required
      • messagestringrequired
      • codestring