Skip to content
DevelopersIn development

Webhooks

Webhooks let RapidRoot push events to your systems instead of you polling for changes. Delivery is in development — this page documents the intended design, not shipped behaviour.

Status

Webhook delivery is being built alongside the public API. The event catalogue below describes planned categories, not a finalised contract. Field names and payload shapes will change before general availability.

Event-driven model

You register an HTTPS endpoint per workspace and subscribe to the event categories you care about. When something happens on the platform, RapidRoot sends a JSON POST to your endpoint. Your endpoint should acknowledge quickly with a 2xx and process the payload asynchronously.

  • HTTPS endpoints only.
  • One event per request, with an event identifier for de-duplication.
  • Acknowledge within a short timeout; do the real work in a background job.
  • Treat delivery as at-least-once and make handlers idempotent.
Example format — payload shape is not final
POST https://yourapp.example/hooks/rapidroot
Content-Type: application/json

{
  "id": "evt_01H...",
  "type": "conversation.resolved",
  "created_at": "2026-01-01T10:15:00Z",
  "data": {
    "conversation_id": "cnv_2h81",
    "channel": "whatsapp",
    "resolved_by": "ai"
  }
}

Event categories

Message events

In development

Message sent, delivered, read, failed, and inbound message received.

Conversation events

In development

Conversation opened, assigned, resolved or reopened.

Call events

In development

Call started, answered, completed, missed or transferred to a human.

Campaign events

In development

Broadcast started, completed, and per-recipient outcome summaries.

Contact events

In development

Contact created or updated, opt-in and opt-out changes.

Retry philosophy

  • Non-2xx responses and timeouts are retried with exponential backoff.
  • Retries stop after a bounded window; undelivered events remain visible in the dashboard.
  • Repeated failures will surface as an endpoint health warning rather than silently dropping events.
  • Exact attempt counts and intervals will be published with general availability instead of guessed at now.

Signature verification

In developmentSigned payloads

Each webhook will carry a signature header derived from a per-endpoint signing secret so you can verify the request came from RapidRoot. Verify the signature before trusting any payload, and compare using a constant-time comparison.

Example format
X-RapidRoot-Signature: t=1767261300,v1=<hex_digest>

// verify: HMAC-SHA256(signing_secret, timestamp + "." + raw_body)
// reject if the timestamp is outside your tolerance window

Roadmap

  • In development — endpoint registration, message and call events, signed delivery.
  • Planned — event replay from the dashboard, per-event filtering, expanded event catalogue.
  • Planned — delivery logs with response bodies for debugging.