Hellou AI Webhooks API

openapi: 3.2.0
info:
  title: HellouOne Webhooks API
  version: 1.0.0
  description: 'The HellouOne REST API: everything the dashboard does, available to your

    own systems — CRMs, bots, BI tools and back-office automation.'
  termsOfService: https://hellou.ai/en/legal/terms/
  contact:
    name: HellouOne support
    email: support@hellou.ai
servers:
- url: https://one.hellou.ai
  description: HellouOne cloud
security:
- userApiKey: []
tags:
- name: Webhooks
paths:
  /api/v1/accounts/{account_id}/webhooks:
    parameters:
    - $ref: '#/components/parameters/account_id'
    get:
      tags:
      - Webhooks
      operationId: list-all-webhooks
      summary: List all webhooks
      description: 'Lists the account''s webhooks with their signing secrets, plus the events this

        account can subscribe to.


        **Administrators only.**'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/webhook_list'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
    post:
      tags:
      - Webhooks
      operationId: create-a-webhook
      summary: Add a webhook
      description: 'Subscribes a URL to events. The response carries the webhook''s signing

        secret, generated on creation.


        **Administrators only.**'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/webhook_create_update_payload'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/webhook_payload'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '422':
          $ref: '#/components/responses/unprocessable'
  /api/v1/accounts/{account_id}/webhooks/{webhook_id}:
    parameters:
    - $ref: '#/components/parameters/account_id'
    - $ref: '#/components/parameters/webhook_id'
    patch:
      tags:
      - Webhooks
      operationId: update-a-webhook
      summary: Update a webhook
      description: 'Changes the URL or the subscribed events. The signing secret is unchanged.


        **Administrators only.**'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/webhook_create_update_payload'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/webhook_payload'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not_found'
        '422':
          $ref: '#/components/responses/unprocessable'
    delete:
      tags:
      - Webhooks
      operationId: delete-a-webhook
      summary: Delete a webhook
      description: 'Removes the webhook; no further events are sent to its URL.


        **Administrators only.**'
      responses:
        '200':
          description: Deleted
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not_found'
  /api/v1/accounts/{account_id}/webhooks/{webhook_id}/rotate_secret:
    parameters:
    - $ref: '#/components/parameters/account_id'
    - $ref: '#/components/parameters/webhook_id'
    post:
      tags:
      - Webhooks
      operationId: rotateWebhookSecret
      summary: Rotate a webhook's signing secret
      description: 'Replaces the signing secret and returns the webhook with the new one. The old

        secret stops verifying at once — including for deliveries already queued — so

        update your receiver as soon as you rotate.


        **Administrators only.**'
      responses:
        '200':
          description: The webhook, with its new secret
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/webhook_payload'
        '401':
          $ref: '#/components/responses/unauthorized'
        '403':
          $ref: '#/components/responses/forbidden'
        '404':
          $ref: '#/components/responses/not_found'
components:
  schemas:
    webhook_payload:
      type: object
      properties:
        payload:
          type: object
          properties:
            webhook:
              $ref: '#/components/schemas/webhook'
          required:
          - webhook
      required:
      - payload
    webhook_list:
      type: object
      properties:
        payload:
          type: object
          properties:
            webhooks:
              type: array
              items:
                $ref: '#/components/schemas/webhook'
            available_events:
              type: array
              description: The events this account can subscribe to, given its plan's features.
              items:
                $ref: '#/components/schemas/webhook_event'
          required:
          - webhooks
          - available_events
      required:
      - payload
    webhook_create_update_payload:
      type: object
      properties:
        url:
          type: string
          description: The URL events are POSTed to (http or https)
        subscriptions:
          type: array
          description: 'The events to receive. Subscribing to an event your plan does not include

            answers 422; a subscription made before the feature was turned off is kept

            but no longer delivered.

            '
          items:
            $ref: '#/components/schemas/webhook_event'
    error_message:
      type: object
      description: An error with a human-readable message.
      properties:
        error:
          type: string
          description: What went wrong.
        reason:
          type: string
          description: Machine-readable cause, when there is one (for example `feature_disabled`).
      required:
      - error
    webhook_event:
      type: string
      description: 'A webhook event name. Some events exist only for accounts with the matching

        feature; `GET /webhooks` lists the ones this account can subscribe to in

        `available_events`.

        '
      enum:
      - conversation_created
      - conversation_status_changed
      - conversation_updated
      - contact_created
      - contact_updated
      - message_created
      - message_updated
      - webwidget_triggered
      - inbox_created
      - inbox_updated
      - whatsapp_flow_completed
      - kb_document_status_changed
      - facebook_lead_received
      - facebook_lead_processed
      - call_started
      - call_ended
      - call_summarized
      - voice_campaign_contact_resolved
      - voice_campaign_sweep_launched
      - voice_campaign_sweep_series_ended
      - voice_follow_up_replied
      - marketing_consent_changed
      - whatsapp_campaign_status_changed
      - whatsapp_campaign_reply
    webhook:
      type: object
      properties:
        id:
          type: integer
          description: The ID of the webhook
        url:
          type: string
          description: The URL events are POSTed to
        account_id:
          type: integer
          description: The account the webhook belongs to
        subscriptions:
          type: array
          description: The events this webhook receives
          items:
            $ref: '#/components/schemas/webhook_event'
        secret:
          type: string
          description: 'The signing secret. Every delivery carries

            `X-HellouOne-Signature: sha256=<HMAC-SHA256(secret, raw body)>`; see

            *Webhook events* for how to verify it. Rotate it with

            `POST /webhooks/{webhook_id}/rotate_secret`.

            '
        inbox:
          type: object
          description: Present when the webhook was created for one inbox.
          properties:
            id:
              type: integer
            name:
              type: string
      required:
      - id
      - url
      - subscriptions
      - secret
    validation_error:
      type: object
      description: Validation failure for a record.
      properties:
        message:
          type: string
          description: Every validation message, joined with commas.
        attributes:
          type: array
          description: The attributes that failed validation.
          items:
            type: string
      required:
      - message
  parameters:
    webhook_id:
      in: path
      name: webhook_id
      required: true
      description: The numeric ID of the webhook
      schema:
        type: integer
    account_id:
      in: path
      name: account_id
      required: true
      description: The numeric ID of the account
      schema:
        type: integer
  responses:
    unauthorized:
      description: Missing or invalid `api_access_token`, or a bot token on an endpoint bots cannot use.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error_message'
    forbidden:
      description: 'Not allowed: the user''s role does not permit it, the feature is not enabled

        for the account (`reason: feature_disabled`), or the account is read-only.

        '
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error_message'
    not_found:
      description: The resource does not exist in this account.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error_message'
    unprocessable:
      description: The request was understood but the data is invalid.
      content:
        application/json:
          schema:
            anyOf:
            - $ref: '#/components/schemas/validation_error'
            - $ref: '#/components/schemas/error_message'
  securitySchemes:
    userApiKey:
      type: apiKey
      in: header
      name: api_access_token
      description: 'A user''s access token, from **Profile settings → Access token** in the dashboard.

        Requests act with that user''s role: administrators reach everything in their

        account, agents only what their role and visibility settings allow.

        '
    agentBotApiKey:
      type: apiKey
      in: header
      name: api_access_token
      description: 'An agent bot''s access token, shown to administrators on the bot''s settings page.

        Bot tokens reach a limited set of conversation and message endpoints.

        '
    platformAppApiKey:
      type: apiKey
      in: header
      name: api_access_token
      description: 'A platform app token, issued by the installation operator. Used to provision

        accounts, users, account memberships and agent bots.

        '
    connectorInvokeToken:
      type: http
      scheme: bearer
      description: 'A connector''s invoke token (`hci_…`), sent as `Authorization: Bearer <token>`.

        Each connector install has its own; it is rotated whenever the connector is

        reconnected or disconnected, so a stale copy stops working.

        '
x-tagGroups:
- name: Guides
  tags:
  - Introduction
  - Authentication
  - Errors
  - Pagination
  - Rate limits
  - Webhook events
- name: Webhook payloads
  tags:
  - Event payloads
- name: Platform
  tags:
  - Accounts
  - Account Users
  - AgentBots
  - Users
- name: Application
  tags:
  - Account AgentBots
  - Agents
  - Automation Rule
  - Campaigns
  - Canned Responses
  - Contacts
  - Contact Labels
  - Conversation Assignment
  - Conversation Labels
  - Conversations
  - Custom Attributes
  - Custom Filters
  - Help Center
  - Inboxes
  - Integrations
  - Macros
  - Messages
  - Profile
  - Reports
  - Security Settings
  - Teams
  - Webhooks
- name: Business tools
  tags:
  - AI Classifications
  - Assignment Settings
  - Calls
  - AI Phone Lines
  - Connectors
  - ElevenLabs Integration
  - Facebook Marketing
  - HellouAI Integration
  - Knowledge Base
  - Marketing Consent
  - Plan Upgrades
  - Voice Campaigns
  - WhatsApp Campaigns
  - WhatsApp Flows
  - WhatsApp Templates
- name: Client
  tags:
  - Inbox API
  - Contacts API
  - Conversations API
  - Messages API
- name: Others
  tags:
  - CSAT Survey Page