Webhook Subscriptions

Create a webhook subscription

POST

/webhook_subscriptions

package main

import (
  "fmt"
  "strings"
  "net/http"
  "io"
)

func main() {

  url := "https://api.kirimdev.com/v1/webhook_subscriptions"

  payload := strings.NewReader("{ \"url\": \"https://example.com\", \"description\": \"example\", \"events\": [ \"message.received\" ], \"phone_number_ids\": [ \"example\" ] }")

  req, _ := http.NewRequest("POST", url, payload)

  req.Header.Add("Idempotency-Key", "order-20260910-0001")
  req.Header.Add("Authorization", "Bearer <token>")
  req.Header.Add("Content-Type", "application/json")

  res, _ := http.DefaultClient.Do(req)

  defer res.Body.Close()
  body, _ := io.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))

}

const url = 'https://api.kirimdev.com/v1/webhook_subscriptions';
const options = {
  method: 'POST',
  headers: {
    'Idempotency-Key': 'order-20260910-0001',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: '{"url":"https://example.com","description":"example","events":["message.received"],"phone_number_ids":["example"]}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

use serde_json::json;
use reqwest;

#[tokio::main]
pub async fn main() {
    let url = "https://api.kirimdev.com/v1/webhook_subscriptions";

    let payload = json!({
        "url": "https://example.com",
        "description": "example",
        "events": ("message.received"),
        "phone_number_ids": ("example")
    });

    let mut headers = reqwest::header::HeaderMap::new();
    headers.insert("Idempotency-Key", "order-20260910-0001".parse().unwrap());
    headers.insert("Authorization", "Bearer <token>".parse().unwrap());
    headers.insert("Content-Type", "application/json".parse().unwrap());

    let client = reqwest::Client::new();
    let response = client.post(url)
        .headers(headers)
        .json(&payload)
        .send()
        .await;

    let results = response.unwrap()
        .json::<serde_json::Value>()
        .await
        .unwrap();

    dbg!(results);
}

curl --request POST \
  --url https://api.kirimdev.com/v1/webhook_subscriptions \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: order-20260910-0001' \
  --data '{ "url": "https://example.com", "description": "example", "events": [ "message.received" ], "phone_number_ids": [ "example" ] }'

Create a webhook subscription. Store initial_secret server-side immediately. It is returned in the initial response and replayed for 24 hours when the same POST is retried with the same Idempotency-Key; outside that replay, Kirimdev cannot show it again.

Authorizations

bearerAuth

Parameters

Header Parameters

Idempotency-Key

Optional retry key. Reusing the same key with the same method, path, and body within 24 hours returns the original response; reusing it for a different request returns 422.

string

Example

order-20260910-0001

Optional retry key. Reusing the same key with the same method, path, and body within 24 hours returns the original response; reusing it for a different request returns 422.

Request Body

application/json

object

url

required

string format: uri

description

string

<= 200 characters

events

required

Array<string>

>= 1 items

Allowed values: message.received message.status message.sent message.revoked message.edited conversation.assigned conversation.closed contact.created contact.updated contact.identity_updated customer.created customer.updated customer.archived customer.onboarded customer.setup_link.created customer.setup_link.consumed

phone_number_ids

Array<string>

<= 50 items

Responses

200

Created

application/json

object

data

required

object

required

string

object

required

string

Allowed values: webhook_subscription

url

required

string format: uri

description

required

string | null

events

required

Array<string>

phone_number_ids

required

Optional whitelist of Meta business_phone_number_id values. When null (default), the subscription fires for events from every WhatsApp account in the organization. When an array, only for events originating from these accounts. Org-level events (e.g. customer.*) IGNORE this filter and always fire.

Array<string> | null

status

required

string

Allowed values: active paused disabled

disabled_reason

required

Why the subscription is CURRENTLY disabled. Cleared when you re-enable it.

string | null

last_disabled_at

required

When the subscription last entered the disabled state. Never cleared, so it still reports a past auto-disable after you have re-enabled.

string | null format: date-time

last_disabled_reason

required

string | null

consecutive_failures

required

integer

secrets

required

Array<object>

object

required

string

created_at

required

string format: date-time

expires_at

required

string | null format: date-time

created_at

required

string format: date-time

updated_at

required

string format: date-time

initial_secret

string

request_id

required

Unique request identifier to include when contacting support.

string

Example

{
  "data": {
    "id": "wbs_01HXYZABCDEFGHJKMNPQRSTVWX",
    "object": "webhook_subscription",
    "phone_number_ids": [
      "1234567890"
    ],
    "status": "active",
    "secrets": [
      {
        "id": "sec_01HXYZABCDEFGHJKMNPQRSTVWX"
      }
    ]
  },
  "request_id": "req_01HXYZABCDEFGHJKMNPQRSTVWX"
}

400

Validation failure

application/json

object

error

required

object

type

required

string

Allowed values: invalid_request_error authentication_error permission_error not_found conflict rate_limit_error api_error

code

required

string

message

required

Human-readable explanation of the error.

string

param

Request field associated with the error, when applicable.

string

request_id

required

Unique request identifier to include when contacting support.

string

Examples

default

A field value is invalid.

{
  "error": {
    "type": "invalid_request_error",
    "code": "invalid_field_value",
    "message": "A field value is invalid.",
    "request_id": "req_01HXYZABCDEFGHJKMNPQRSTVWX"
  }
}

401

Authentication failure

application/json

object

error

required

object

type

required

string

Allowed values: invalid_request_error authentication_error permission_error not_found conflict rate_limit_error api_error

code

required

string

message

required

Human-readable explanation of the error.

string

param

Request field associated with the error, when applicable.

string

request_id

required

Unique request identifier to include when contacting support.

string

Examples

default

The provided API key is invalid.

{
  "error": {
    "type": "authentication_error",
    "code": "invalid_api_key",
    "message": "The provided API key is invalid.",
    "request_id": "req_01HXYZABCDEFGHJKMNPQRSTVWX"
  }
}

409

Conflict (e.g. template already exists, webhook subscription disabled, setup link inactive)

application/json

object

error

required

object

type

required

string

Allowed values: invalid_request_error authentication_error permission_error not_found conflict rate_limit_error api_error

code

required

string

message

required

Human-readable explanation of the error.

string

param

Request field associated with the error, when applicable.

string

request_id

required

Unique request identifier to include when contacting support.

string

Examples

default

An identical request is still being processed. Retry later.

{
  "error": {
    "type": "conflict",
    "code": "idempotency_in_progress",
    "message": "An identical request is still being processed. Retry later.",
    "request_id": "req_01HXYZABCDEFGHJKMNPQRSTVWX"
  }
}

422

Semantic failure (e.g. idempotency key reuse, pre-send compliance guard, media not found)

application/json

object

error

required

object

type

required

string

Allowed values: invalid_request_error authentication_error permission_error not_found conflict rate_limit_error api_error

code

required

string

message

required

Human-readable explanation of the error.

string

param

Request field associated with the error, when applicable.

string

request_id

required

Unique request identifier to include when contacting support.

string

Examples

default

Idempotency-Key was reused with a different request body.

{
  "error": {
    "type": "invalid_request_error",
    "code": "idempotency_key_reuse",
    "message": "Idempotency-Key was reused with a different request body.",
    "request_id": "req_01HXYZABCDEFGHJKMNPQRSTVWX"
  }
}

429

Rate limit exceeded

application/json

object

error

required

object

type

required

string

Allowed values: invalid_request_error authentication_error permission_error not_found conflict rate_limit_error api_error

code

required

string

message

required

Human-readable explanation of the error.

string

param

Request field associated with the error, when applicable.

string

request_id

required

Unique request identifier to include when contacting support.

string

Examples

default

Rate limit exceeded.

{
  "error": {
    "type": "rate_limit_error",
    "code": "rate_limit_exceeded",
    "message": "Rate limit exceeded.",
    "request_id": "req_01HXYZABCDEFGHJKMNPQRSTVWX"
  }
}

500

Internal server error

application/json

object

error

required

object

type

required

string

Allowed values: invalid_request_error authentication_error permission_error not_found conflict rate_limit_error api_error

code

required

string

message

required

Human-readable explanation of the error.

string

param

Request field associated with the error, when applicable.

string

request_id

required

Unique request identifier to include when contacting support.

string

Examples

default

An unexpected error occurred.

{
  "error": {
    "type": "api_error",
    "code": "internal_error",
    "message": "An unexpected error occurred.",
    "request_id": "req_01HXYZABCDEFGHJKMNPQRSTVWX"
  }
}

503

Service unavailable

application/json

object

error

required

object

type

required

string

Allowed values: invalid_request_error authentication_error permission_error not_found conflict rate_limit_error api_error

code

required

string

message

required

Human-readable explanation of the error.

string

param

Request field associated with the error, when applicable.

string

request_id

required

Unique request identifier to include when contacting support.

string

Examples

default

Service temporarily unavailable.

{
  "error": {
    "type": "api_error",
    "code": "service_unavailable",
    "message": "Service temporarily unavailable.",
    "request_id": "req_01HXYZABCDEFGHJKMNPQRSTVWX"
  }
}