Skip to content
Developers

Webhooks

Xat CRM sends a POST to your URL when something happens in your workspace. You configure endpoints from Settings → Webhooks.

Events

Each endpoint subscribes to the events you choose. These are all of them.

message

  • message.received
  • message.sent

conversation

  • conversation.created
  • conversation.updated
  • conversation.resolved

contact

  • contact.created
  • contact.updated

inbox

  • inbox.connected
  • inbox.disconnected

9

Delivery format

Every delivery is a POST with this body and these headers.

Headers

X-Xat-Event: <event>
X-Xat-Delivery: <id>
X-Xat-Signature: sha256=<hex>
User-Agent: XatCRM-Webhooks/1.0

Body

{
  "id": …,
  "event": …,
  "organizationId": …,
  "occurredAt": …,
  "data": …
}

Verifying the signature

Every delivery is signed with the endpoint secret. Compute the HMAC-SHA256 of the body exactly as received — do not re-serialize it — and compare it with the signature header. The secret is shown once, when the endpoint is created.

X-Xat-Signature
sha256=<hex>
HMAC
HMAC-SHA256

Retries

If your endpoint does not answer successfully, the delivery is retried with growing backoff. An endpoint that keeps failing is disabled automatically, so a dead URL cannot keep burning the queue.

Attempts per delivery
6
Backoff between attempts
30s1m2m4m8m
Disabled after
20 consecutive failures

Redirects are not followed: on a signed POST they always mean a misconfiguration.

Repeated deliveries

A retry repeats the same delivery, carrying the same identifier in its header. Use that identifier to discard duplicates on your side.

X-Xat-Delivery