Overview

Webhooks

Subscribe your endpoint to WhatSetter events. Deliveries are signed:

Header	Value
`X-Whatsetter-Event`	the event type
`X-Whatsetter-Delivery`	unique delivery id (`evt_…`): use it to dedupe
`X-Whatsetter-Timestamp`	ISO-8601
`X-Whatsetter-Api-Version`	`2026-06-01`
`X-Whatsetter-Signature`	`sha256=<hex>`: HMAC-SHA256 of the raw body with your subscription secret

Verify (Node.js):

const crypto = require('crypto');
const expected = 'sha256=' + crypto.createHmac('sha256', SECRET).update(rawBody, 'utf8').digest('hex');
const valid = crypto.timingSafeEqual(Buffer.from(header), Buffer.from(expected));

Events:

contact.qualified / contact.not_qualified: a lead was (dis)qualified by the AI
booking.created: a call was booked in chat
message.received: a lead sent an inbound message (high volume)
agent.disconnected: a WhatsApp number went offline

Delivery is at-least-once: dedupe on event_id. Payloads carry is_test: true when triggered from a test.