> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.muchau.com.br/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.muchau.com.br/_mcp/server. # Criar um webhook POST https://dev.muchau.com.br/api/webhooks/ Content-Type: application/json Cria um novo endpoint de webhook. O `secret` retornado é exibido apenas uma vez — armazene-o com segurança para verificar assinaturas de requisições recebidas. Reference: https://docs.muchau.com.br/api/reference/webhooks/criar-um-webhook ## Authentication - `Authorization` header (bearer token, required) — API Key in the format `mk_live_<43-chars>`. Obtain from the Dashboard or `POST /auth/api-keys`. ## Request ### Body (application/json) This endpoint expects an object. - `url` (string, required) — HTTPS endpoint URL that will receive webhook POST requests. Each delivery is signed with HMAC-SHA256 using the webhook secret. - `events` (list of enum, required) — List of event types to subscribe to. At least one event type is required. - Allowed values: `message.received`, `message.sent`, `message.delivered`, `message.read`, `message.failed`, `number.activated`, `number.disconnected`, `number.banned`, `flow.data_exchange` - `numberIds` (list of string, optional) — Optional list of WhatsApp Business number IDs to filter events for. If omitted, events for all numbers are delivered. - `contacts` (list of string, optional) — Optional list of contacts (phone numbers or BSUIDs) to restrict deliveries to. If any webhook restricts a contact, ALL events for that contact go only to contact-restricted webhooks; default catch-all webhooks are bypassed for that contact. ## Response ### 201 Default Response - `id` (string, required) — Unique identifier of the webhook - `url` (string, required) — HTTPS endpoint URL that receives webhook POST requests - `events` (list of string, required) — List of event types this webhook is subscribed to - `numberIds` (list of string, required) — List of number IDs this webhook is filtered to. Empty array means all numbers. - `contacts` (list of string, required) — List of contacts this webhook is restricted to. Empty array means all contacts (catch-all). - `active` (boolean, required) — Whether the webhook is currently active. Automatically set to false after 10 consecutive delivery failures. - `createdAt` (string, required) — ISO 8601 timestamp when the webhook was created - `secret` (string, optional) — HMAC-SHA256 signing secret for verifying webhook payloads. Only returned on creation and secret rotation. Store it securely — it cannot be retrieved again. - `failureCount` (double, optional) — Number of consecutive delivery failures. Resets to 0 on a successful delivery. Webhook is auto-disabled at 10. - `lastStatusCode` (double, optional, nullable) — HTTP status code returned by the endpoint on the most recent delivery attempt - `lastTriggeredAt` (string, optional, nullable) — ISO 8601 timestamp of the most recent delivery attempt - `updatedAt` (string, optional) — ISO 8601 timestamp when the webhook was last updated ## Errors ### 400 Bad Request Error Default Response - `error` (ApiWebhooksPostResponsesContentApplicationJsonSchemaError, required) ### 401 Unauthorized Error Default Response - `error` (ApiWebhooksPostResponsesContentApplicationJsonSchemaError, required) ## Types ### ApiWebhooksPostResponsesContentApplicationJsonSchemaError - `code` (string, required) — Machine-readable error code (e.g., UNAUTHORIZED, NOT_FOUND, VALIDATION_ERROR) - `message` (string, required) — Human-readable error description - `status` (integer, required) — HTTP status code - `meta` (ApiWebhooksPostResponsesContentApplicationJsonSchemaErrorMeta, optional) - `error_shield` (ApiWebhooksPostResponsesContentApplicationJsonSchemaErrorErrorShield, optional) ### ApiWebhooksPostResponsesContentApplicationJsonSchemaErrorMeta - `meta_code` (integer, required) - `meta_message` (string, required) - `meta_subcode` (integer, required, nullable) - `type` (string, required, nullable) - `fbtrace_id` (string, required, nullable) - `error_data` (any, optional) ### ApiWebhooksPostResponsesContentApplicationJsonSchemaErrorErrorShield - ApiWebhooksPostResponsesContentApplicationJsonSchemaErrorErrorShield0 - ApiWebhooksPostResponsesContentApplicationJsonSchemaErrorErrorShield1 ### ApiWebhooksPostResponsesContentApplicationJsonSchemaErrorErrorShield0 - `matched` (boolean, required) - `entry_id` (string, required) - `category` (enum, required) - Allowed values: `template`, `number`, `messaging`, `flow`, `permission`, `rate_limit`, `other` - `severity` (enum, required) - Allowed values: `informational`, `recoverable`, `blocking`, `critical` - `actor` (enum, required) - Allowed values: `developer`, `end_client`, `muchau` - `human_message` (ApiWebhooksPostResponsesContentApplicationJsonSchemaErrorErrorShieldOneOf0HumanMessage, required) - `action` (ApiWebhooksPostResponsesContentApplicationJsonSchemaErrorErrorShieldOneOf0Action, required) - `action_url` (string, required, nullable) - `docs_url` (string, required) - `copy_text` (ApiWebhooksPostResponsesContentApplicationJsonSchemaErrorErrorShieldOneOf0CopyText, required) - `version` (integer, required) - `last_updated` (string, required) ### ApiWebhooksPostResponsesContentApplicationJsonSchemaErrorErrorShield1 - `matched` (boolean, required) - `note` (ApiWebhooksPostResponsesContentApplicationJsonSchemaErrorErrorShieldOneOf1Note, required) ### ApiWebhooksPostResponsesContentApplicationJsonSchemaErrorErrorShieldOneOf0HumanMessage - `pt` (string, required) - `en` (string, required) ### ApiWebhooksPostResponsesContentApplicationJsonSchemaErrorErrorShieldOneOf0Action - `pt` (string, required) - `en` (string, required) ### ApiWebhooksPostResponsesContentApplicationJsonSchemaErrorErrorShieldOneOf0CopyText - `pt` (string, required, nullable) - `en` (string, required, nullable) ### ApiWebhooksPostResponsesContentApplicationJsonSchemaErrorErrorShieldOneOf1Note - `pt` (string, required) - `en` (string, required) ## Examples **Request** ```json { "url": "https://webhooks.example.com/whatsapp", "events": [ "message.received" ] } ``` **Response** ```json { "id": "wh_9f8b7c6d5e4a3b2c1d0e", "url": "https://webhooks.example.com/whatsapp", "events": [ "message.received" ], "numberIds": [], "contacts": [], "active": true, "createdAt": "2024-05-30T09:15:00Z", "secret": "a1b2c3d4e5f67890123456789abcdef0123456789abcdef0123456789abcdef", "failureCount": 0, "lastStatusCode": 200, "lastTriggeredAt": "2024-06-01T12:00:00Z", "updatedAt": "2024-05-30T09:15:00Z" } ``` **SDK Code** ```python import requests url = "https://dev.muchau.com.br/api/webhooks/" payload = { "url": "https://webhooks.example.com/whatsapp", "events": ["message.received"] } headers = { "Authorization": "Bearer ", "Content-Type": "application/json" } response = requests.post(url, json=payload, headers=headers) print(response.json()) ``` ```javascript const url = 'https://dev.muchau.com.br/api/webhooks/'; const options = { method: 'POST', headers: {Authorization: 'Bearer ', 'Content-Type': 'application/json'}, body: '{"url":"https://webhooks.example.com/whatsapp","events":["message.received"]}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go package main import ( "fmt" "strings" "net/http" "io" ) func main() { url := "https://dev.muchau.com.br/api/webhooks/" payload := strings.NewReader("{\n \"url\": \"https://webhooks.example.com/whatsapp\",\n \"events\": [\n \"message.received\"\n ]\n}") req, _ := http.NewRequest("POST", url, payload) req.Header.Add("Authorization", "Bearer ") req.Header.Add("Content-Type", "application/json") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby require 'uri' require 'net/http' url = URI("https://dev.muchau.com.br/api/webhooks/") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Post.new(url) request["Authorization"] = 'Bearer ' request["Content-Type"] = 'application/json' request.body = "{\n \"url\": \"https://webhooks.example.com/whatsapp\",\n \"events\": [\n \"message.received\"\n ]\n}" response = http.request(request) puts response.read_body ``` ```java import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.post("https://dev.muchau.com.br/api/webhooks/") .header("Authorization", "Bearer ") .header("Content-Type", "application/json") .body("{\n \"url\": \"https://webhooks.example.com/whatsapp\",\n \"events\": [\n \"message.received\"\n ]\n}") .asString(); ``` ```php request('POST', 'https://dev.muchau.com.br/api/webhooks/', [ 'body' => '{ "url": "https://webhooks.example.com/whatsapp", "events": [ "message.received" ] }', 'headers' => [ 'Authorization' => 'Bearer ', 'Content-Type' => 'application/json', ], ]); echo $response->getBody(); ``` ```csharp using RestSharp; var client = new RestClient("https://dev.muchau.com.br/api/webhooks/"); var request = new RestRequest(Method.POST); request.AddHeader("Authorization", "Bearer "); request.AddHeader("Content-Type", "application/json"); request.AddParameter("application/json", "{\n \"url\": \"https://webhooks.example.com/whatsapp\",\n \"events\": [\n \"message.received\"\n ]\n}", ParameterType.RequestBody); IRestResponse response = client.Execute(request); ``` ```swift import Foundation let headers = [ "Authorization": "Bearer ", "Content-Type": "application/json" ] let parameters = [ "url": "https://webhooks.example.com/whatsapp", "events": ["message.received"] ] as [String : Any] let postData = JSONSerialization.data(withJSONObject: parameters, options: []) let request = NSMutableURLRequest(url: NSURL(string: "https://dev.muchau.com.br/api/webhooks/")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "POST" request.allHTTPHeaderFields = headers request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```