/settings/workspace/webhooks)
Plan: Growth or Advanced (not on Starter). See billing — pricing.
Quick reference
What webhooks do
When an event happens in your workspace (e.g. customer sends WhatsApp text), Vendschat POSTs JSON to every active destination subscribed to that event type.Example: Pulse Digital agency
Pulse routes VIP WhatsApp messages to Slack:- Settings → Webhooks → Add destination
- Name:
VIP Slack alert - URL: Make webhook URL (
https://hook.eu1.make.com/...) - Events:
incoming.whatsapp.messages.textonly (start narrow) - Save signing secret when shown
- Make scenario → filter by label later → post to
#vip-sales
outgoing.whatsapp.status.delivered when they need delivery receipts.
Webhooks page layout
Section header: Webhooks — “Create and manage webhooks for receiving real-time notifications across all your channels.”Event destinations
Toolbar:
- Add destination — create new webhook
- Import — import destinations (bulk)
- Search — filter table by text
- Filter by Channel — narrow by channel scope
1 of 3 at bottom when many destinations exist.
Creating a destination (step by step)
Path: Add destination →/settings/workspace/webhooks/create
After save:
- Destination appears in table as Active
- A signing secret is generated (
whsec_…) — store it securely; use it to verify requests on your server
Payload envelope
Each delivery is a JSON POST with headers:
Body shape:
Complete event catalog
Events use the pattern{direction}.{channel}.{detail}.
Cross-channel (Vendschat)
Subscribe to these for “catch everything” logging.
WhatsApp — incoming
WhatsApp — outgoing & status
Instagram — incoming
Instagram — outgoing & status
Messenger — incoming
Messenger — outgoing & status
Public docs: Each event also has a page at
https://docs.vendschat.com/webhooks/events/… (linked from the product event picker when available).
Common recipes
Tip: Start with one event. Add more after your endpoint handles volume.
Connecting automation platforms
Set source to
make, zapier, or n8n when creating via that platform (helps filtering in support).
Managing destinations
Active vs Disabled: Disabled rows show neutral badge; enabled rows show green Active.
Security
- Use HTTPS endpoints in production
- Verify X-VendsChat-Signature with your
whsec_…secret - Reject requests with stale timestamps (replay protection)
- Rotate secrets when team members with access leave
- Do not paste signing secrets in Chat with customers
- Subscribe only to events you process — reduces noise and attack surface