---
title: "Before message submission"
method: POST
path: "message.before_submit.v1"
tags: ["Hooks"]
---

# Before message submission

`POST message.before_submit.v1` (webhook)

Checks a user message before it is queued or sent to the agent. Includes the sender, message text, and attachments, but not conversation history.

Destinations share a five-second deadline and are not retried. Any `deny` blocks submission. Errors and invalid responses follow the subscription's configured failure behavior. Subscription discovery failures block submission.

Return HTTP `200` with `application/json` and an `allow` or `deny` decision (maximum 64 KiB). See [signature verification](/api-reference/events-and-hooks#verify-signatures).

## Headers

- `webhook-id` string, required
- `webhook-timestamp` string, required
- `webhook-signature` string, required

## Payload

- ExternalMessageBeforeSubmitV1
  - `data` ExternalBeforeMessageSubmitData, required
    - `attachments` ExternalMessageAttachment[], nullable
      - `mime_type` string, required: Client-supplied MIME type, inferred from the filename when omitted, or application/octet-stream when unknown. Receivers should verify the content type themselves.
      - `name` string, required
      - `url` string, uri, required: Signed download URL valid for five minutes from generation; anyone with this URL can download the file.
    - `message` string, required
    - `message_id` string, required
    - `thread_id` string, required: Thread in the project's trajectory, or the workspace trajectory when project_id is absent.
    - `user_id` string, required
  - `id` string, required: Hook execution identity shared by all matching subscriptions.
  - `occurred_at` string, date-time, required
  - `project_id` string: Absent for workspace chats. Referencing a project does not make a message project-scoped.
  - `type` 'message.before_submit.v1', required
  - `workspace_id` string, required

## Acknowledgement `200`

Synchronous hook result.

- ExternalMessageBeforeSubmitV1Response
  - `decision` 'allow' | 'deny', required
  - `reason` string: Explanation shown to the user when submission is denied.

---

[API](https://skmtc.dev/lovable/apis/lovable-api.md) - [All operations](https://skmtc.dev/lovable/apis/lovable-api/llms.txt) - [OpenAPI document](https://skmtc.dev/lovable/apis/lovable-api/revisions/ed671816c468?raw)