Webhooks & callbacks
Current release · Updated October 2, 2026
DryKraft webhooks & callbacks API: methods, permissions, request fields, response shapes, examples and current limits. Read authentication and error handling first.
/api/billing/dodo/webhookReceive Dodo events
Access: Dodo signature · Success: 200
Raw JSON bytes. Required webhook-id, webhook-timestamp and webhook-signature headers. HMAC-SHA256 over id.timestamp.rawBody with decoded whsec key; v1,base64 signature, timestamp ±300 seconds. Dedupe webhook ID; fetch current subscription before changing access. Unrelated types/products acknowledged.
JSON request
| Field | Type | Required | Details |
|---|---|---|---|
type | string | Yes | Event type |
data | object | Yes |
Response
| Field | Type | Required | Details |
|---|---|---|---|
received | true | No |
Use the provider configuration or private generated link described above; this is not a session-based example.
/api/hooks/{token}Trigger webhook workflow
Access: Secret hook token · Success: 202
64-character hex token. Active published webhook trigger and billing access required. Optional Idempotency-Key <=200 characters: repeated identical payload returns same execution; changed payload is 409.
JSON request
object. Object field values. Only keys in the workspace object definition are allowed; required fields and field types are validated.
Response
| Field | Type | Required | Details |
|---|---|---|---|
execution_id | uuid | No | |
state | string | No | Execution state |
Use the provider configuration or private generated link described above; this is not a session-based example.
/api/outreach/oauth/{provider}/callbackComplete mailbox consent
Access: Account session · Success: 302
Provider callback, not a manual API call. Matching one-use state/session required; exchanges code and stores encrypted offline grant. Redirects to Outreach connections; cancellation also redirects.
Query parameters
| Parameter | Type | Required | Details |
|---|---|---|---|
state | string | Yes | Required OAuth state |
code | string | No | Required when error is absent. Omit on provider denial/cancellation. Max 4000 characters. |
error | string | No | Provider denial/cancellation |
No request body is required.
Response
string. HTTP redirect, Location header
Use the provider configuration or private generated link described above; this is not a session-based example.
/api/outreach/whatsapp/{id}Verify Meta callback
Access: Meta verify token · Success: 200
Connection-specific endpoint. hub.mode=subscribe and matching hub.verify_token required; returns challenge as plain text.
Query parameters
| Parameter | Type | Required | Details |
|---|---|---|---|
hub.mode | subscribe | Yes | |
hub.verify_token | string | Yes | Private connection token |
hub.challenge | string | Yes | Required challenge Max 200 characters. |
No request body is required.
Response
string.
Use the provider configuration or private generated link described above; this is not a session-based example.
/api/outreach/whatsapp/{id}Receive Meta messages
Access: Meta signature · Success: 200
Raw JSON bytes; X-Hub-Signature-256 = sha256=hex HMAC-SHA256(body, appSecret). Checks WABA and phone IDs, dedupes messages, updates delivery/read receipts. Incoming text stops follow-ups; STOP/unsubscribe/cancel/quit permanently suppresses. AI only for eligible inbound messages within 24 hours.
JSON request
object. Meta whatsapp_business_account event with entry[].id, changes[].field=messages, value.metadata.phone_number_id and messages/statuses.
Response
| Field | Type | Required | Details |
|---|---|---|---|
received | true | No |
Use the provider configuration or private generated link described above; this is not a session-based example.
/api/outreach/unsubscribe/{token}Show unsubscribe confirmation
Access: Secret unsubscribe token · Success: 200
64-character hex token in email link. Branded HTML form; GET does not suppress.
No request body is required.
Response
string. HTML confirmation page
Use the provider configuration or private generated link described above; this is not a session-based example.
/api/outreach/unsubscribe/{token}Confirm unsubscribe
Access: Secret unsubscribe token · Success: 200
No body required. Stops follow-ups and permanently suppresses the recipient for this workspace/channel. Supports one-click unsubscribe. Returns branded HTML success.
No request body is required.
Response
string. HTML success page
Use the provider configuration or private generated link described above; this is not a session-based example.