POST /api/webhooks. An empty events array subscribes
to every event; an optional session restricts delivery to one session.
Manage webhooks in the Console
Open team Settings → Webhooks to list, add, edit, enable, disable, or delete webhook endpoints. Each endpoint supports a public URL, an optional event selection, native or Meta-compatible format, an optional signing secret, and a retry policy. Retry attempts range from0 to 10, and retry delay ranges from 0 to
3600 seconds. Policies are constant, linear, or exponential. Leaving
the event selection empty subscribes the endpoint to every supported event.
The Console never displays a stored signing secret; enter a replacement to
rotate it or explicitly clear it.
Delivery formats
Both signatures are HMAC-SHA256 over the exact raw HTTP body using
hmacKey.
Compare in constant time before parsing JSON. The signature is absent when no
key is configured.
Retry configuration
retries.attempts, retries.delaySeconds, and retries.policy are stored per
webhook. Policies are constant, linear, or exponential; exponential delay
is capped at five minutes. The default is three attempts, five seconds, and
exponential backoff.
Current event catalog
The Messaging API OpenAPI document publishes all payload types throughx-webhooks.
There are 31 current events:
x-webhooks operation for the exact
payload. Common message fields include typed JIDRef, media metadata, reaction,
poll, edit, and unavailable-state fields; session, group, contact, call, and
command events each have their own named component.
Receiver rules
- Return any
2xxonly after the event is durably accepted. - Deduplicate with the event identifier from the delivered envelope.
- Expect retries and possible cross-webhook reordering.
- Do not log raw bodies or signature secrets; message payloads may contain customer content.
- Use
format: "meta"when migrating an existing Meta webhook consumer andnativefor the complete Polymorfa event catalog.
x-webhooks section documents event bodies.