support.* events

A member sends a message into a support conversation.

When this fires

Every time a member sends an inbound message that lands in the support inbox, including the very first one, which also raises support.conversation.opened.

This is the workhorse of the family. If you are routing member questions into a helpdesk, an ops channel or an on-call rota, this is the event to subscribe to.

It does not fire when:

  • The text was a recognised bot command, or an answer the bot was waiting for mid-setup.
  • The member is blocked. Their messages are dropped without a trace in the inbox.
  • The member has tripped the inbound rate limit. Excess messages are dropped silently rather than queued.
  • The member edited an earlier message. The stored message is updated in place and no new event fires.

The message body is not in the payload. Webhook deliveries are logged and retried, and member text does not belong in a delivery log. Fetch it with the conversation messages endpoint.

Caveats

  • No body, no name, no file ids. Everything human-readable is behind the API on purpose. Platform file ids are effectively credentials for downloading the file and are never sent in a webhook.
  • An album (several photos sent together) arrives as one event per part, each with its own message_id. They share a media_group_id visible through the API, not in the payload.
  • A captioned photo has type: "photo", and the caption is the message body; it is not a separate text message.
  • A caption that starts with / is parsed as a bot command upstream and never reaches the inbox.

Related events

  • support.conversation.opened: fires alongside on the member's first message.
  • support.message.sent: your side of the exchange.
  • support.conversation.reopened: fires alongside when the message revives a resolved thread.
postWebhooksupport.message.received

Headers

SB-Signaturestring required

t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.

SB-Event-Idstring required

The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.

SB-Event-Namestring required

The event name, the same as the envelope's type.

Content-Typestring required

Always application/json.

User-Agentstring required

Always Subscriby-Webhooks/1.0.

Payload

idstring required

A ULID unique to the event, prefixed evt_. Every retry carries the same id, so it is the key to deduplicate on.

type'support.message.received' required

The event name, always support.message.received here.

created_atstring date-time required

When the event was emitted, server time, ISO 8601.

api_versionstring required

The contract version of the payload shape, 2026-05-01 today. A breaking change to a shape ships under a new version.

project_idstring uuid nullable required

The project the event belongs to; null for team-scoped and billing events.

Response

Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.