> ## Documentation Index
> Fetch the complete documentation index at: https://docs.revbridge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhooks

> Receive delivery, open, click, bounce and other messaging events on your own server as they happen.

A webhook sends a message event to your server when it happens: an email delivered, a link clicked, a WhatsApp message read. Use it to keep your CRM or data warehouse in sync with what RevBridge sends.

Open **Settings → Webhooks**. Webhooks belong to the workspace selected at the top of the app.

## Create a webhook

**1. Click New webhook**

The **Create webhook** form opens.

**2. Name it and add your URL**

RevBridge sends a `POST` with a JSON body to this URL whenever one of the selected events occurs.

**3. Choose the service**

Each webhook covers one **Service**: Email, SMS or WhatsApp. To receive events from more than one, create one webhook per service.

**4. Choose the events**

Select the events you want. See the list below.

**5. Add a secret (recommended)**

With a **Secret**, RevBridge signs every request so your server can confirm it came from RevBridge. See [Verify the signature](#verify-the-signature).

**6. Click Create**

Then click **Send test** on the webhook to check that your server receives it.

## Events

| Service | Events |
| - | - |
| **Email** | Sent, Delivered, Deferred, Bounced, Soft bounce, Hard bounce, Rejected, Failed, Suppressed, Opened, Clicked, Complaint, Unsubscribed |
| **SMS** | Message sent, Message delivered, Message failed, Message received |
| **WhatsApp** | Message sent, Message delivered, Message read, Message failed, Message received |

## What each request carries

| Header | Content |
| - | - |
| `X-Webhook-Event` | The event type |
| `X-Webhook-Message-Id` | The ID of this event |
| `X-Webhook-Timestamp` | When it was sent, in Unix seconds |
| `X-Webhook-Signature` | Only with a secret: `sha256=` followed by the signature |

## Verify the signature

The signature is an HMAC-SHA256 of the raw request body, using your secret as the key, written in hexadecimal. Compute it on your side and compare.

```javascript theme={null}
import crypto from "node:crypto";

function isFromRevBridge(rawBody, signatureHeader, secret) {
  const expected =
    "sha256=" + crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  return (
    signatureHeader?.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(signatureHeader), Buffer.from(expected))
  );
}
```

> [!WARNING]
>
> Compute the signature over the body exactly as received. Parsing the JSON and serializing it again changes the bytes, and the signature won't match.

## Manage webhooks

The list shows each webhook's name, URL, service, events, status and creation date. From each row you can:

* **Send test**: queue a test event to your URL.
* **Disable** / **Enable**: pause and resume deliveries without losing the setup.
* **Delete**: stop sending to this URL for good. This can't be undone.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.