Webhooks

A Voxpanda webhook sends a signed JSON POST to your URL the moment something happens in your workspace, such as a published post, a new comment or an automated reply. Use it to connect Voxpanda to Zapier, Make, n8n, a CRM or your own server. Owners and admins manage webhooks in API & MCP, under Webhooks.

Add a webhook

1. Open API & MCP in the menu.
2. In Webhooks, enter the Endpoint URL. It must start with https://.
3. Add a Description so your team knows what the endpoint is for.
4. Tick the Events you want.
5. Select Add webhook.
6. Copy the signing secret. It starts with whsec_ and is shown only once.

Send test queues a webhook.test event so you can check your receiver before real events arrive.

Events

What a delivery looks like

Every delivery is a POST with a JSON body:

{
  "id": "6f1c0d6e-1d1a-4b51-9d0e-3f1a5c0d9e21",
  "event": "comment.received",
  "created_at": "2026-10-25T04:05:19Z",
  "workspace_id": "…",
  "brand_id": "…",
  "data": { "platform": "instagram", "kind": "comment", "author": "sari", "text": "How much is it?" }
}

The request carries three headers:

• Voxpanda-Event: the event name.
• Voxpanda-Delivery: the delivery id. It stays the same when Voxpanda retries, so use it to skip duplicates.
• Voxpanda-Signature: t=<unix time>,v1=<signature>.

Verify the signature

The signature is an HMAC-SHA256, in hex, of the text t.body: the t value, a dot, and the raw request body. The key is your full whsec_ secret. Reject requests older than 5 minutes.

import crypto from 'node:crypto';

function verify(secret, rawBody, header) {
  const parts = Object.fromEntries(header.split(',').map((p) => p.split('=')));
  if (Math.abs(Date.now() / 1000 - Number(parts.t)) > 300) return false;
  const mac = crypto.createHmac('sha256', secret).update(`${parts.t}.${rawBody}`).digest('hex');
  return mac.length === parts.v1.length && crypto.timingSafeEqual(Buffer.from(mac), Buffer.from(parts.v1));
}

Use the raw body as received. Parsing the JSON and printing it again changes the bytes and the signature no longer matches.

Answer quickly

Reply with any 2xx status within 10 seconds. Voxpanda does not follow redirects and reads at most 4 KB of your response. Do slow work after you answer.

Retries and automatic turn-off

After the sixth failed attempt the delivery is marked Gave up. When an endpoint fails 25 times in a row, Voxpanda turns it off and shows the reason. Fix your receiver, then select Turn on. The failure count resets.

Rotate the secret

Select New secret to create a new signing secret. The old one stops working at once, so update your receiver right after.