Webhook delivery (bot → your middleware)
When the bot emits a message, Landbot POSTs this payload to the webhook URL configured on the APIchat channel.
Outbound only — bot messages only. Customer messages you push to POST /send/{customer_token}/ advance the flow but do NOT fire a webhook back. No authenticity header: APIchat sends no Authorization header and has no outbound-secret field. Authenticate by other means (hard-to-guess URL suffix, IP allowlist of GCP egress ranges, reverse-proxy gate). User-Agent: landbot/webhooks. Retries (diverges from Platform): any non-2xx, including 4xx, is retried on linear backoff (deltas ~5/10/15/20/25 s, ≥6 attempts). To reject permanently you must still return 2xx and discard internally. Timeout ≥30 s. Dedupe on the sentry-trace header (stable across retries).
Payload
Response
Acknowledged. Return any 2xx; body ignored. Remember 4xx is also retried.
Changes
Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.