Webhooks

Configure an HTTPS endpoint in the dashboard (webhook endpoints are dashboard-only, not MCP). Deliveries POST a JSON envelope and sign the raw body with HMAC-SHA256. Verify header X-Bootstrapware-Signature (hex digest) using your endpoint secret.

Webhooks carry operational identifiers only. They do not include message body or file bytes. Participant ids are allowed on conversation created. A failed delivery is retried once.

Events

• chat.conversation_created (appId, conversationId, participantIds)
• chat.message_created / chat.message_updated / chat.message_deleted (appId, conversationId, messageId, authorId)
• chat.member_added / chat.member_removed (appId, conversationId, memberId)

Envelope shape

{
  "event": "chat.message_created",
  "workspaceId": "ws_...",
  "productId": "chat",
  "timestamp": "2026-09-05T12:00:00.000Z",
  "data": { /* event-specific ids only */ }
}

Verify signature (Node)

Compare the header to HMAC-SHA256 of the exact raw request body (hex). Use a timing-safe compare:

import { createHmac, timingSafeEqual } from "node:crypto";

function verifyBootstrapwareSignature(
  rawBody: string,
  header: string | null,
  secret: string,
) {
  if (!header) return false;
  const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(header, "hex");
  if (a.length !== b.length) return false;
  return timingSafeEqual(a, b);
}

Parse JSON only after verification. Do not re-serialize the body before hashing. The signature is over the bytes that were POSTed.

BYO does not emit these

Hosted conversation and message events emit Bootstrapware Chat webhooks. BYO adapters keep content on your backend and do not emit Bootstrapware chat webhooks for your store. Wire your own notifications from your API if you need them.

Narrative guide: Chat webhooks.

Related: Webhooks guide · Sessions · API overview · Security