Member webhook by API

The member webhook tells your server each time someone joins a community of an event. The payload, the signature and the retries are described in the guide page and in Outbound webhooks. This page covers the API calls. Reference: Webhooks.

ReadCopy Anchor Link

GET /v1/events/{event_id}/member-webhook

{
  "url": "https://hooks.example.com/groupilot",
  "secret_configured": true,
  "recent_deliveries": [
    { "id": "…", "type": "member.joined", "status": "delivered", "attempt_count": 1, "last_http_status": 200, "last_error_code": null, "created_at": "…", "completed_at": "…" }
  ]
}

read scope. The last 10 deliveries are included; phone numbers and payloads never are.

Set or remove the URLCopy Anchor Link

PUT /v1/events/{event_id}/member-webhook
{ "url": "https://hooks.example.com/groupilot" }

write scope. HTTPS only, public host, no credentials in the URL. The first time, the response carries signing_secret: store it, it is never shown again. { "url": null } disables the webhook. 409 on a stopped event.

Rotate the secretCopy Anchor Link

POST /v1/events/{event_id}/member-webhook/rotate-secret

Returns { "signing_secret": "whsec_…", "rotated_at": "…" }. The old secret stops validating immediately: deploy the new one first on your side, then rotate.

Send a testCopy Anchor Link

POST /v1/events/{event_id}/member-webhook/test

Queues a webhook.test delivery and attempts it right away. The response is { "delivery_id": "…", "status": "delivered", "http_status": 200 }; status is pending when Groupilot will retry, failed when your side refused it.

Verify what you receiveCopy Anchor Link

X-Groupilot-Signature: t=<unix seconds>,v1=<hex> where v1 is HMAC-SHA256(secret, t + "." + rawBody). Reject a t older than 5 minutes, deduplicate on the envelope id. Code sample in the guide.