🔗 Webhooks
Webhooks are how channel providers notify PulseHub when something happens — a customer sends a message, a delivery status changes, etc.
Webhook URL Pattern
https://yourdomain.com/webhooks/{channel_type}/{channel_id}
Webhook Verification (GET requests)
Some providers verify your webhook URL with a challenge before sending real messages:
WhatsApp / Facebook / Instagram
PulseHub checks hub.verify_token and echoes back hub.challenge.
Telegram
No verification GET — setting the webhook via Bot API is sufficient.
Viber
Sends a conversation_started event on first open. PulseHub returns {"status": 0}.
Signature Verification
| Provider | Header | Secret |
|---|---|---|
| WhatsApp/Facebook/Instagram | X-Hub-Signature-256 | App Secret |
| Viber | X-Viber-Content-Signature | Auth Token |
| Twilio | — | URL-based security |
| Telegram | — | UUID-based URL security |
All HMAC comparisons use hash_equals() (constant-time).
Event Logging
Every webhook payload is logged to the webhook_events table with status = pending. After processing: processed. On failure: failed.
Failed Webhook Retry
The cron job retries failed events up to 5 times within 24 hours.