This article lists the events you can subscribe to with Atlas webhooks, shows the payload format, and explains how to verify that a request really comes from Atlas.
Related articles: •Webhooks in Atlas: Create, edit and delete webhook subscriptions. •API keys in Atlas: Send requests to Atlas from your own applications.
Key Features
JSON payloads: Every event is sent as an HTTP POST request with a JSON body.
Signed requests: Atlas signs each payload with your subscription's "Secret Key" (HMAC).
Account, conversation, message, customer and session events: Subscribe to the changes that matter to your workflows.
How to verify the webhook signature
Atlas uses HMAC (Hash-based Message Authentication Code) signing to prove that a request comes from Atlas and wasn't tampered with.
When an event triggers, Atlas signs the raw JSON body with your subscription's "Secret Key" and adds the signature to a request header (for example, X-Atlas-Signature).
Your server receives the raw JSON body and the signature header.
Your server computes an HMAC hash of the raw JSON body with your saved "Secret Key" and compares it with the signature:
Signatures match: The request is authentic. Return 200 OK.
Signatures don't match: Reject the request with 401 Unauthorized.
Important: Endpoint URLs are public. Verifying the signature stops third parties from sending fake payloads to your server.
Payload format
All events are sent as HTTP POST requests with a JSON body like this:
