Delivery and Signatures

Platica sends every webhook as a POST with Content-Type: application/json. If you configure a secret, we also include an HMAC-SHA256 signature so you can verify the event comes from Platica.

Envelope

Conversation, message, comment, customer, ads, and WhatsApp Flows events arrive in this envelope:

{
  "id": "9f8c...",
  "event": "conversation.created",
  "workspaceId": "ws_456",
  "timestamp": "2026-05-06T19:00:00.000Z",
  "source": "system.conversation.created",
  "resourceType": "conversation",
  "resourceId": "conv_123",
  "changes": null,
  "data": {}
}

See List events for the 22 available events and Payloads for the contents of data and the possible values of source.

Headers

Validate the signature

The signature is computed with HMAC-SHA256 over the raw body (rawBody) received by your endpoint:

sha256=<hmac_sha256(secret, rawBody)>

Node.js example:

const crypto = require('crypto');

function verifyWebhook(secret, rawBody, signatureHeader) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signatureHeader)
  );
}

Responses and retries

Your endpoint must respond with a 2xx status code when it processes the event successfully. For conversation, message, comment, customer, and ads events, your response body is not used to continue any flow; it only confirms the webhook was received.