Skip to main content
Webhooks let iBubbl push events to your backend shortly after they happen — inbound replies from your contacts, delivery state changes, reactions, opt-outs. You avoid the latency and rate-limit cost of polling. The first delivery attempt usually arrives within a minute of the event. There is no latency guarantee, so don’t build logic that depends on precise timing.

Subscription model

You register an HTTPS URL via POST /v1/webhooks. iBubbl returns a subscription with a signing secret. You can register multiple subscriptions per account — one per environment, one per service, or one filtered to a subset of event types.
If you omit event_types (or pass null or []), the subscription receives all events, including event types added later. See the Webhook Events catalog for the full list.

Changing a subscription

Subscriptions can’t be edited. To change the URL or the event filter, create a new subscription, switch your endpoint to its new signing secret, then revoke the old one. Both receive events while they overlap, with the same event ids, so your de-duplication covers the switch.

The signing secret

The create response includes a secret field (format: whsec_<64 hex chars>). This is the only time the full secret is returned. Store it immediately in your secrets manager. You use the secret to verify the X-iBubbl-Signature header on every incoming webhook POST, ensuring the request actually came from iBubbl and wasn’t forged. See Signature verification for the algorithm and reference verifiers in Python + Node. If you lose the secret, revoke the subscription and create a new one — iBubbl cannot recover or re-display it.

Delivery and retries

Delivery is at least once, in no guaranteed order. Your endpoint must return a 2xx within 10 seconds; anything else, including a 3xx or a timeout, is retried up to 5 attempts over about 37 minutes, then marked dead. De-duplicate on the event id. Retries and deduplication has the exact schedule, what iBubbl does and doesn’t do after a failure, and de-duplication code.

Best practices

Process asynchronously. iBubbl’s 10s timeout is firm; slow endpoints look like failures and trigger unnecessary retries.
Use the event id, plus data.message_id and type for the rare change recorded twice. Never de-duplicate on content. See Retries and deduplication.
Don’t make exceptions for “internal” testing or “trusted” networks. Signature verification is cheap and catches forged requests + misrouted traffic. See Signature verification.
Settings → Webhooks → Recent deliveries shows every attempt, its HTTP status and retry state. Use it to spot endpoints that are silently failing. To try it out, see Test webhooks locally.

What’s next

Webhook Events

The catalog of event types and their payload shapes.

Signature verification

HMAC-SHA256 verification with reference code in Python + Node, and a test vector.

Retries and deduplication

The retry schedule, and handling duplicates and out-of-order events.

Test webhooks locally

Receive real events on your laptop through a tunnel.