What events can I subscribe to?

Workspace events from the audit record, covering conversations, sends, approvals, contacts and channel connections. An endpoint receives only what it subscribes to.

How do I verify a delivery?

Each delivery is signed with the secret shown when you created the endpoint. Compute the signature over the payload and compare before trusting it.

What if my endpoint goes down?

Failures are counted, and an endpoint that keeps failing is disabled. Re-enable it once your service is back.

Can I rotate the signing secret?

Yes. Rotation is supported so a leaked secret can be replaced without deleting the endpoint and its subscriptions.

Is there a public API?

Yes. Endpoints for contacts, conversations, messages and campaigns, authenticated with your workspace keys, following the same permission, consent and audit rules as the interface.

Will API sends bypass consent?

No. Anything that sends passes the same consent, suppression, conversation window and duplicate protection as a message sent from the interface.

Yes. A key carries scopes, is listed masked after creation, records when it was last used and can be revoked immediately.

Can I export data instead?

Contacts export to CSV from the workspace. For a continuous feed, webhooks are the intended path.

Will I receive duplicate deliveries?

Delivery is at least once, which is normal for webhooks. Treat the event identifier as the key and make your handler safe to run twice.

Marketing and growth

Send the events to your systems.

Signed outbound webhooks for the events you subscribe to, with keys and scopes managed in the workspace.

Webhooks let one system tell another that something happened, in real time, without the second system polling for changes. For a messaging platform that means a business can push conversation and campaign events into its own data warehouse, order system or internal tools, and act on them with its own code.

Subscribe an endpoint to the events you care about
Every delivery signed so you can verify it came from us
Failures counted, with automatic disabling of a dead endpoint
API keys minted with scopes and revoked when needed

How it works.

01
Register an endpoint
Add the URL that should receive events and choose which ones it subscribes to, so an endpoint only gets what it asked for.
02
Store the secret
A signing secret is shown once when the endpoint is created. Keep it, because it is what proves a delivery came from your workspace.
03
Verify and act
Check the signature on each delivery before you trust it, then do whatever your system needs to do with the event.
04
Watch the health
Failures are counted per endpoint, and an endpoint that keeps failing is disabled.

Events from the same record as the audit

Outbound events come from the workspace audit record, which means what your systems receive is the same thing your audit shows.

Conversation, send, approval, contact and channel events
The same record your own audit page shows
One workspace only

Signed and verifiable

Any public endpoint receives noise. A signature computed with your own secret is how your system tells a real delivery from a forged one.

Signature computed with a per endpoint secret
Secret shown once at creation and rotatable afterwards
Endpoints enabled, disabled and deleted from the workspace

Keys with scopes

Keys are minted in the workspace, shown once, listed masked afterwards, and carry the scopes that decide what they can reach.

Mint a key with the scopes it needs
Listed masked, with when it was last used
Revoked immediately when it should stop working
Key creation and revocation written to the audit record

The public API^soon

Endpoints for contacts, conversations, messages and campaigns, authenticated with your workspace keys and following the same permission and consent rules the interface does.

Read and write endpoints under a versioned path
Cursor pagination and a consistent error shape
A retry never sends the same message twice
The same consent, window and audit rules as the interface

What it does not do.

Webhooks deliver events. They are not a way to send messages into Otobiz.
There is no single export of an entire workspace beyond contacts.

Common questions

What events can I subscribe to?: Workspace events from the audit record, covering conversations, sends, approvals, contacts and channel connections. An endpoint receives only what it subscribes to.
How do I verify a delivery?: Each delivery is signed with the secret shown when you created the endpoint. Compute the signature over the payload and compare before trusting it.
What if my endpoint goes down?: Failures are counted, and an endpoint that keeps failing is disabled. Re-enable it once your service is back.
Can I rotate the signing secret?: Yes. Rotation is supported so a leaked secret can be replaced without deleting the endpoint and its subscriptions.
Is there a public API?: Yes. Endpoints for contacts, conversations, messages and campaigns, authenticated with your workspace keys, following the same permission, consent and audit rules as the interface.
Will API sends bypass consent?: No. Anything that sends passes the same consent, suppression, conversation window and duplicate protection as a message sent from the interface.
Are API keys scoped?: Yes. A key carries scopes, is listed masked after creation, records when it was last used and can be revoked immediately.
Can I export data instead?: Contacts export to CSV from the workspace. For a continuous feed, webhooks are the intended path.
Will I receive duplicate deliveries?: Delivery is at least once, which is normal for webhooks. Treat the event identifier as the key and make your handler safe to run twice.

The reason a customer comes back a second time.