Webhooks

WeZend's webhook model is per-message, not a global event subscription. There's no dashboard screen where you register "notify me about every future delivery" — instead, you pass webhook_url directly on the send request (or per-message inside a bulk request), and status updates for that message are POSTed there as they happen.

{
  "to": "+4512345678",
  "channel": "sms",
  "message": "Your order has shipped.",
  "webhook_url": "https://yourapp.com/hooks/wezend"
}

Payload and headers

Every delivery includes:

• X-ZafeConnect-Event — the event name
• X-ZafeConnect-Timestamp — Unix ms timestamp used in the signature
• X-ZafeConnect-Signature — HMAC-SHA256 of ${timestamp}.${JSON.stringify(payload)}, using the webhook signing secret from Settings → Webhook secret

These headers currently carry the platform's original "ZafeConnect" name rather than "WeZend" — a branding detail in the backend that hasn't been renamed yet, not something you need to work around. Verify the signature the same way regardless of the header prefix.

Verify the signature

const crypto = require("crypto");

function verify(rawBody, timestamp, signature, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

Retries

If your endpoint doesn't respond 2xx, delivery is retried 3 times — after 30 seconds, 5 minutes, then 30 minutes — and retries survive a restart or deploy (they're durable, backed by the database, not an in-memory queue). Respond quickly and process asynchronously rather than doing slow work in the request handler.

Inbound vendor delivery receipts

The /v1/webhooks/messente, /v1/webhooks/twilio, /v1/webhooks/vonage and /v1/webhooks/whatsapp endpoints are how upstream carriers report delivery back to the platform — they're platform-internal and not something you configure; they exist so WeZend itself can populate the statuses you see via webhook_url and the message history API.