Webhooks overview

Webhooks push events to your server as they happen, so you do not have to poll the v1 API.

Register an endpoint

Settings → Webhooks in the dashboard: give a URL and pick which events it should receive. Up to 20 endpoints per workspace.

The signing secret — a whsec_… value — is shown once, when the endpoint is created. Store it immediately; it is what proves a delivery came from evoriqa. See Signatures.

Endpoints can be paused and deleted. A paused or deleted endpoint is skipped at delivery time, and deliveries always use the endpoint's current secret.

The request you receive

Every delivery is a POST with Content-Type: application/json and three headers:

Header	Contents
`X-Evoriqa-Event`	The event name, e.g. `lead.created`
`X-Evoriqa-Delivery`	A UUID identifying this event — stable across retries
`X-Evoriqa-Signature`	HMAC-SHA256 of the raw body, hex encoded

The body:

{
  "id": "9f1c1c2a-1b21-4f7c-9d0f-6a3a4a1c9d55",
  "event": "lead.created",
  "data": {
    "id": "5b3e…",
    "chatbotId": "0c21…",
    "email": "someone@example.com",
    "name": "Sam Rivera",
    "phone": null
  },
  "ts": 1786290764000
}

id matches the X-Evoriqa-Delivery header, event matches X-Evoriqa-Event, and ts is the emit time in milliseconds. Both id and ts are minted once at emit and are byte-identical on every retry, which is what makes the body's signature verifiable and the event dedupable.

Responding

Return any 2xx and evoriqa records the delivery as successful. Anything else — or a timeout — counts as a failure and is retried. See Retries and the delivery log.

Respond quickly and do your work afterwards: acknowledge first, process second.

Which events exist

Exactly three: lead.created, conversation.created, and csat.received. See Events for payloads and for what is deliberately not delivered.

Where to go next

Last updated 8 August 2026