WhatSyncs is launching with 3 WhatsApp connections free. Start Free →
Webhooks
Register an HTTPS endpoint and WhatSyncs posts events to it as they happen: incoming and outgoing messages, delivery and read status, synchronized media, history batches and connection state changes. Payloads can be signed, failures are retried with backoff, and every attempt is logged.
Event catalogue
Subscribe to everything, or only to what your integration acts on. Every payload names the connection it came from, so routing by team or branch is a field lookup rather than a guess.
whatsapp.message.received An inbound message arrived on a connected number.
whatsapp.message.sent An outbound message was sent from a connected number.
whatsapp.message.status Delivery or read status changed for a message.
whatsapp.media.synced Media attached to a message finished synchronizing.
whatsapp.history.synced A batch of available conversation history was synchronized.
connection.connected A WhatsApp session linked successfully.
connection.syncing A session is catching up after linking or reconnecting.
connection.reconnecting A session dropped and is being restored.
connection.disconnected A session is no longer linked and needs attention.
Security
Webhook payloads can be signed with a shared secret. Your endpoint recomputes the HMAC over the timestamp and raw body and compares it in constant time before acting on anything. An unsigned or mismatched request is rejected with a 401.
Delivery
Return a 2xx as soon as you have durably accepted the event, then do the real work out of band. A handler that writes to a CRM synchronously will eventually time out, and a timeout is treated as a failure — which means a retry, which means duplicates if you are not deduplicating.
A WhatsApp webhook is an HTTPS request that a platform sends to your server when something happens on a connected WhatsApp account — a message arriving, a file finishing its sync, a session dropping.
It inverts the usual direction of integration work: instead of your system asking "anything new?" on a timer, the event arrives the moment it exists.
Latency and cost. Polling every thirty seconds means conversations reach the CRM up to thirty seconds late while spending requests on empty responses.
Webhooks also carry information polling cannot easily reconstruct, such as the exact moment a session dropped.
Deliveries fail and are retried with backoff, and each attempt is recorded in the delivery log with the status code your endpoint returned.
When you come back up, the retries resume. For anything the retry window did not cover, the REST API lets you list conversations and reconcile.
Store the idempotency key that arrives with each delivery and check it before writing. Retries reuse the key, so a repeat is easy to recognise.
Message identifiers are stable too, which means your write can be an upsert keyed on the message rather than a blind insert.
Implementation checklist
Five things separate an endpoint that works in a demo from one that survives a busy Monday.
Compute the signature over the raw request body, then reject anything that does not match.
Acknowledge, enqueue, return. Never call a third-party API inside the handler.
Record the idempotency key and treat a repeat as an update, not an insert.
A status update can arrive before the message it refers to. Key on the message id and reconcile.
Download URLs are short-lived and authenticated. Pull the file in your worker, not in the handler.
Treat connection.disconnected like any other integration alarm. Someone needs to re-link the number.
FAQ
Yes. Incoming and outgoing messages, message status updates and connection events are delivered to your endpoint as they happen. Payloads can be signed so your systems can verify that an event originated from WhatSyncs, and failed deliveries are retried.
Every message carries a stable identifier, and WhatSyncs reconciles messages seen through real-time events, reconnects and history synchronization against it. Webhook deliveries also carry an idempotency key so a retry does not create a second record in your CRM.
Yes. Every connected session is monitored continuously and surfaced with a status such as healthy, syncing, reconnecting or disconnected. Connection events can also be delivered to your webhook endpoint so your own alerting can react.
Yes, and it is one of the most common setups. Custom and in-house systems integrate the same way as commercial CRMs: point a webhook endpoint at WhatSyncs to receive events and call the REST API to send messages or pull conversations.
Yes. Available media — images, videos, documents and PDFs — is synchronized alongside the conversation data and can be retrieved through the API, so attachments end up on the customer record rather than on one person's phone.
Webhooks, signatures and delivery logs are included on the Free plan.