Skip to main content
Your webhook is where we hand you the conversation. Every visitor message, button click, and form answer arrives there as a signed POST.

​
What your endpoint needs

  • HTTPS only. Plain http:// is refused.
  • A public address. Private, local, and cloud-internal addresses are blocked for security.
  • No redirects. A 3xx is a hard fail. We never follow it.
  • Answer within 10 seconds.

​
Verification is required

A webhook bot cannot go active until its URL passes a check. Changing the URL clears the check — you verify again. This stops a typo from quietly eating every customer message. Press Verify and we send a webhook.verify event:
Send the challenge back. Two forms work:
We are forgiving here on purpose: Content-Type does not matter, extra spaces are fine, and one pair of wrapping quotes is allowed — which covers Make’s habit of quoting values. Extra JSON keys are fine too, which covers n8n’s Respond node.
The key name is case-sensitive. {"Challenge": "…"} fails.
A check is never retried — it runs once per press, with a 10-second limit. Just press it again.

​
When it fails

Zapier Catch Hooks cannot return a custom body, so we skip the echo for zapier.com and *.zapier.com — any 2xx counts. We match the real hostname, so look-alikes such as zapier.com.example.org do not qualify. Instead, you paste the verification_code into the wizard within 30 minutes. See the Zapier guide.

​
Every request carries these headers

​
Retries and repeats

If a try fails in a way we can retry — a timeout, a network error, a 408, 425, 429, or any 5xx — we try up to 4 times in total: Other 4xx responses and redirects fail at once, with no retry.
Spot repeats with X-MyAIChatbot-Event-Id. It is the same on every try of one event, and the body is re-sent byte for byte, with only a fresh signature time. Without this check, one slow response can charge a card twice.
Do not read delivery_attempt from the body — it is always 1. The X-MyAIChatbot-Attempt header is the real counter.

​
Order

Messages carry a per-conversation seq number that only goes up. Delivery order is not promised — a visitor sending two quick messages can cause two overlapping webhook calls. If order matters, sort by message.seq, not arrival time.

​
Testing

The Test webhook button sends a canned event with "test": true, waits up to 10 seconds, and shows you the status, the speed, and exactly what we understood from your reply — including any problems. Test events are logged, but never retried, and they never touch a real conversation.
Check test before doing anything you cannot undo. Both webhook.verify and webhook.test set it.

​
Delivery log

Every try is recorded: status, event type, try count, response status, speed, and the first 2 KB of your reply. Failed deliveries can be retried by hand. Statuses you will see:

​
Next

Check signatures

Do not skip this one.

Event reference

Every event and its payload.