Signed direct WhatsApp message and reaction notifications owned by an agent identity. Select these event types before access is approved without enabling the channel. Only received events may include requested conversation context. Unknown delivery is not a failure or permission to resend. If your organization has a signing key, every webhook includes three headers:

• X-Inkbox-Request-ID — UUID for deduplication.
• X-Inkbox-Timestamp — Unix timestamp in seconds.
• X-Inkbox-Signature — sha256={HMAC-SHA256 hex digest} over {request_id}.{timestamp}.{raw_body}.