Webhook

Signed WhatsApp event

Configure the WhatsApp interface, including its access token, phone-number ID and callback settings. POST validation uses the process-wide WHATSAPP_APP_SECRET and the X-Hub-Signature-256 header over the exact raw JSON body. An AgentOS bearer key does not replace this signature.

The expected JSON has object="whatsapp_business_account" and an entry array containing changes[].value.messages[]. Invalid signatures return 403. Non-WhatsApp objects return {"status":"ignored"}; accepted WhatsApp envelopes return a processing acknowledgement while messages run as in-process background tasks.

HTTP 200 does not establish that a model response or outbound message completed, nor does it guarantee work survives a restart. The generated absence of a request-body schema does not remove the signed JSON requirement.

curl --request POST 'https://example.com/whatsapp/webhook'

{  "status": "ok"}