Webhooks

Get a signed POST at your own HTTPS URL when something happens in One Bear. Configure it in Settings > Developer > Webhooks (one endpoint per workspace). The signing secret (whsec_...) is shown once when you create the endpoint; rotate it from the same page.

Events

Event	Fires when
`message.received`	a customer message arrived
`message.sent`	an agent or AI message was delivered
`room.created`	a new conversation was opened
`room.state_changed`	a conversation moved between New / In progress / Resolved
`room.assigned`	a conversation was assigned or reassigned
`order.created`	an order was created
`order.updated`	an order's status, pricing or owner changed
`customer.created`	a customer was created
`customer.updated`	a customer was edited
`ping`	you pressed Send test

Request

POST {your-url}
Content-Type: application/json; charset=utf-8
User-Agent: OneBear-Webhooks/1.0
X-OneBear-Event: customer.created
X-OneBear-Delivery: 8f5def59-a88a-4975-b760-0c553206eb91
X-OneBear-Signature: t=1789540140,v1=6f5436ee...52ea

{
  "id": "evt_2d191c60103e44c5bca56b7eb37d89b0",
    "type": "customer.created",
      "createdAt": "2026-09-16T06:32:13.238Z",
        "companyId": "a32cf9a9-...",
          "resourceId": "397ff8e6-...",
            "data": { "...": "the resource as returned by the REST API (Customer, Room, Message, Order)" }
            }

X-OneBear-Delivery is stable across retries of the same delivery - use it to de-duplicate.

Verifying the signature

The signed string is "{t}.{raw body}", HMAC-SHA256 with your signing secret, lowercase hex. Compare in constant time and reject t older than 5 minutes.

Use the raw request body bytes - re-serialising the JSON will change the bytes and break the signature.

Delivery & retries

Respond with any 2xx within 10 seconds. Anything else, or a timeout, counts as a failure.

Failed deliveries retry up to 5 times: after 1 min, 5 min, 30 min, 2 h, 12 h.

After 24 hours of continuous failures the endpoint is disabled automatically; re-enable it from Settings > Developer.

At most 60 deliveries per minute per workspace.

Delivery history for the last 7 days is available under Delivery history, including manual retry.

Source IP

Deliveries originate from One Bear's Azure egress. Verify by signature, not by IP, as egress addresses can change.

Events#

Request#

Verifying the signature#

Delivery & retries#

Source IP#

Events

Request

Verifying the signature

Delivery & retries

Source IP