Skip to main content
Xobito can push events to a URL on your server in four categories:
  • CRUD events — contacts, statuses, sources are created/updated/deleted
  • Message delivery status events — message.sent, message.delivered, message.read, message.failed (live as of 2026-05-28)
All events POST to the same webhook_url you configure. Message delivery events use a different, simpler payload than CRUD events — see Webhook Events.
These categories still do not fire outbound webhooks: campaigns, template approvals, tickets, and conversations. For those, poll the relevant API endpoint.

​
Configuring webhooks

1

Open Webhook Settings

In your dashboard go to Settings → Webhook Management.
2

Enable webhook access

Toggle Enable Webhook Access on.
3

Set the URL

Enter your webhook_url. Every configured event is POSTed to this URL.
4

Pick the events (CRUD)

Toggle the events you want:
  • Contacts — Create / Update / Delete
  • Statuses (contact status labels) — Create / Update / Delete
  • Sources (contact source labels) — Create / Update / Delete
5

Message delivery status events

These fire automatically for every send when Enable Webhook Access is on. No per-event toggle in the UI — you receive all four (message.sent, message.delivered, message.read, message.failed) at the same webhook_url. If you only want a subset, filter in your handler by event.
6

Save

Changes take effect immediately.

​
Payload

Every webhook POST has this shape: 
{
  "event": "created",
  "model": "App\\Models\\Tenant\\Contact",
  "data": {
    "id": 123,
    "attributes": {
      "firstname": "John",
      "lastname": "Doe",
      "phone": "+14155551234",
      "email": "john@example.com",
      "type": "lead",
      "status_id": 1,
      "source_id": 2
    },
    "relations": {}
  },
  "original": null,
  "timestamp": "2026-04-16T12:34:56+00:00"
}
FieldMeaning
eventOne of "created", "updated", "deleted".
modelFully qualified model class — use this to tell contact/status/source apart.
data.idPrimary key of the record.
data.attributesFull attribute set of the record at the time of the event.
data.relationsReserved for eager-loaded relations (usually empty).
originalUsually null.
timestampISO-8601 time the event was dispatched.
See Webhook Events for every event and an example payload of each.

​
Delivery guarantees

PropertyValue
DeliveryHTTP POST, JSON body
AttemptsUp to 3 total
Backoff1s before attempt 2, 2s before attempt 3 (exponential — first attempt fires immediately)
ExecutionSynchronous — not queued
Timeout30 seconds per attempt
LoggingEvery attempt is written to the internal webhook_logs table, purged after 30 days
Xobito issues a unique signing secret per workspace. If you do not yet have your secret, contact Xobito support to have one issued and rotated.
Because webhooks are executed synchronously, your endpoint latency directly affects Xobito dashboard responsiveness. Return 2xx quickly (ideally under 1 second) and do the heavy work asynchronously on your side.

​
Verifying requests

Every webhook request carries an HMAC-SHA256 signature in the X-Webhook-Signature header. See Webhook Security for how to verify.

​
Testing

There is no “Send test event” button in the current version. To test your endpoint, trigger a real event — for example, create a contact in the dashboard and watch your server for the created POST.

​
Incoming (Meta → Xobito) webhooks

Separate from outbound webhooks above, Xobito also receives inbound events from the Meta Cloud API (incoming messages, delivery receipts, template status changes). These are not customer configurable — they are set up automatically when you connect your Meta Business account. Do not confuse the two systems.

​
Next steps

Webhook Events

The 9 events Xobito actually sends, with example payloads.

Webhook Security

HMAC signature verification.