Recibir mensajes por webhook

Registrás un endpoint HTTPS (panel → Webhooks, o POST /webhook-endpoints) y Connect te POSTea un sobre versionado por cada evento. ⚠ Tu endpoint tiene que aceptar POST con cuerpo JSON (n8n/Make/Zapier ponen el trigger en GET por defecto — cambialo a POST). El sobre no es el payload crudo de Meta: si Meta cambia su forma, tu integración no se rompe. Headers de firma: X-Connect-Signature-256, X-Connect-Timestamp, X-Connect-Delivery-Id (estable entre reintentos → deduplicá con él), X-Connect-Event.

El sobre que POSTeamos a tu endpoint

{
  "id": "evt_7f3a1b2c9d4e5f6a7b8c9d0e1f2a3b4c",
  "type": "message.received",
  "version": "1",
  "createdAt": "2026-08-06T00:31:22.461Z",
  "connection": {
    "id": "conn_4eede070e5a84d1590bdce2ea1d837bc",
    "phoneNumber": "+5493510000000",
    "externalId": "farmacia-lopez"
  },
  "sequence": 12345,
  "data": {
    "message": {
      "id": "wamid.HBgL…",
      "from": "5493511234567",
      "type": "text",
      "text": {
        "body": "hola"
      }
    },
    "contacts": [
      {
        "wa_id": "5493511234567",
        "profile": {
          "name": "Ana"
        }
      }
    ]
  }
}

Cabeceras

Header	Qué es
X-Connect-Event	The event type (e.g. message.received) — branch on this.
X-Connect-Delivery-Id	Stable across retries → deduplicate on it.
X-Connect-Timestamp	Unix seconds; part of the HMAC. Reject deliveries older than ~5 min.
X-Connect-Signature-256	sha256=HMAC(secret, timestamp + '.' + rawBody). Verify before trusting the body.
X-Connect-Token	Optional static header (if you enabled one) — your tool's native Header Auth checks it.