Message received

Incoming webhook deliveries are authenticated with HMAC signature headers (X-Chatway-Signature and X-Chatway-Timestamp), not your Chatway API key.

A visitor sent a new message.

Triggered only for visitor messages.

Use message.received to route an incoming question, add it to a transcript, or prepare a reply. Pass data.conversation.id as conversation_id to Create Message when replying. Use data.message.id to identify the message and the envelope id to detect retries. A message can contain attachments without content, so an absent text field does not mean it is empty. Subscribe to Message sent if your transcript also needs agent replies.

For the complete receive-and-reply flow, see the Quickstart.

postWebhookmessage.received

Headers

X-Chatway-Eventstring required

Event name for this delivery.

X-Chatway-Webhook-Idstring uuid required

Unique webhook subscription ID.

X-Chatway-Delivery-Idstring required

Unique ID for this HTTP delivery attempt (del_ + 32 hex characters). A new value is sent on each retry.

X-Chatway-Delivery-Attemptstring required

Attempt number for this event (1 on first try). Sent as a decimal string in the header.

X-Chatway-Timestampstring required

Unix timestamp in seconds when the request was signed. Sent as a decimal string in the header.

X-Chatway-Signaturestring required

sha256= followed by the lowercase hex HMAC SHA256 of {X-Chatway-Timestamp}.{raw request body}, keyed with your webhook secret. The example is computed for the example body serialized as compact JSON, the example timestamp, and the placeholder secret whsec_exampleSecretForDocsOnly00000000.

Payload

idstring required

Stable event ID (evt_…). Same across HTTP retries for this notification.

eventstring required

Event name. For this webhook, always message.received.

occurred_atstring date-time required

When the business event occurred.

versionstring required

Payload schema version.

Example payload

{
  "id": "evt_1234567890abcdef1234567890abcdef",
  "event": "message.received",
  "data": {
    "message": {
      "id": "679f5ba4-3cbf-42eb-86dc-63566cec6b58",
      "content": "Hello, I need help",
      "attachments": [
        {
          "content": "https://cdn.example.com/files/invoice.pdf",
          "type": "file",
          "mime": "application/pdf",
          "original_file_name": "invoice.pdf",
          "size": 204800
        }
      ],
      "created_at": "2026-02-04T10:31:12Z"
    },
    "conversation": {
      "id": "0f46c0a1-8938-40e3-b2b5-bb56f569fcab",
      "channel": "website",
      "status": "open",
      "widget_name": "Main site widget",
      "identifier": "eouqtiupanm6uvglwshy"
    },
    "visitor": {
      "id": "9b0c5fe6-35ad-459d-b6ba-4288191f84f1",
      "name": "John Doe",
      "email": "john@example.com",
      "phone": "+1XXXXXXXXXX"
    }
  },
  "occurred_at": "2026-02-04T10:31:12Z",
  "version": "2026-09"
}

Response

Return any 2xx status to acknowledge receipt.

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.