Configure an outbound webhook

What you will accomplish

Configure AyuChat to deliver selected workspace events to your HTTPS endpoint and verify each request server-side.

Before you begin

• Create a public HTTPS receiver.
• Choose a secret at least 16 characters long.
• Process work asynchronously and return a quick success response.
• Store delivery ids to avoid duplicate processing.

Supported events

AyuChat outbound webhooks support the current application event allowlist:

contact.created, contact.updated, contact.deleted,
campaign.created, campaign.launched, campaign.completed, campaign.failed,
message.sent, message.delivered, message.read, message.failed,
template.created, template.approved,
automation.started, automation.completed, automation.failed,
form.submitted,
team.member_added, team.member_removed

Step 1 - Add a webhook

1. Open Developer Hub or Workspace Settings.
2. Open Project Webhooks.
3. Add a descriptive name.
4. Enter a safe public HTTPS URL.
5. Enter a secret and select only required events.
6. Save the webhook as active.

Endpoint safety rules

AyuChat rejects localhost, private network, and non-HTTPS webhook URLs. Your endpoint must be reachable from the public internet and should not expose credentials in the URL.

Payload shape

{
  "business_id": 123,
  "data": { "example": "event data" },
  "entity_id": 456,
  "entity_type": "contact",
  "event": "contact.created",
  "signature": "hex_hmac_signature",
  "timestamp": "2026-08-26T10:00:00+00:00"
}

Verify signatures

The signature is an HMAC SHA-256 hash of the canonical JSON payload without the signature field, using your webhook secret.

import crypto from "node:crypto";

function verifyAyuChatWebhook(payloadWithoutSignature, receivedSignature, secret) {
  const body = JSON.stringify(sortKeys(payloadWithoutSignature));
  const expected = crypto.createHmac("sha256", secret).update(body).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(receivedSignature));
}

Retries and delivery logs

AyuChat records deliveries and allows retrying failed deliveries from the authenticated workspace webhook UI. Treat retries as possible duplicates in your system.

Common problems