Chat webhooks

When Hosted conversations appear or messages change, you may want Slack or your own worker notified, without shipping customer prose through the wire.

Chat webhooks carry operational identifiers only. Configure an HTTPS endpoint in the dashboard (webhooks are dashboard-only, not MCP).

Events

Event	When
chat.conversation_created	Hosted conversation created. Data: `appId`, `conversationId`, `participantIds`.
chat.message_created	Hosted message sent. Ids only: app, conversation, message, author.
chat.message_updated	Hosted edit. Ids only.
chat.message_deleted	Hosted delete. Ids only. Body is never included.
chat.member_added	Member added. Data includes memberId.
chat.member_removed	Member removed. Data includes memberId.

Envelope fields also include workspaceId, productId (chat), and timestamp. Reference: webhooks docs.

BYO adapters keep content on your backend and do not emit these Bootstrapware Chat webhooks for your store.

Signature

Deliveries POST JSON and sign the raw body with HMAC-SHA256. The hex digest is sent as header X-Bootstrapware-Signature. A failed delivery is retried once.

import { createHmac, timingSafeEqual } from "node:crypto";

function verifyBootstrapwareSignature(
  rawBody: string,
  header: string | null,
  secret: string,
) {
  if (!header) return false;
  const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(header, "hex");
  if (a.length !== b.length) return false;
  return timingSafeEqual(a, b);
}

Parse JSON only after verification. Do not re-serialize the body before hashing.

Related: Webhooks docs · Security · API overview · Moderate Hosted