Skip to content
Docs

A tool's webhook check

GET
/api/hooks/{connection}

Called by the tool, not by you: WhatsApp checks the address with its verify token here and gets its challenge back. The address to give it is this path with the connection's id.

Path Parameters

connection*string

The connection's id (from GET /api/workspaces/:ws/connections).

Response Body

The tool's challenge, as plain text, when its token matches the connection's.

Example Request
curl -X GET 'https://app.useroster.work/api/hooks/string'
Example Response200
Empty

Connect a tool with OAuth GET

For a connection with an OAuth app's client ID and secret (Linear): redirects the person to the tool to authorise Roster, then back to Integrations → Tools.

A tool's webhook POST

Called by the tool, not by you: WhatsApp, Chatwoot and Twilio send customers' messages here (and Stripe its events), each signed with a secret of the connection's (WhatsApp's X-Hub-Signature-256, Chatwoot's X-Chatwoot-Signature, Twilio's X-Twilio-Signature over this address and the form fields). Unsigned or wrongly signed deliveries are refused; each message is kept once, however often it's sent. Hires read them and are woken by them.