> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blujay.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhook event

> Blujay sends each event as an HTTPS `POST` with a JSON body to the URL on your subscription. Respond with any `2xx` status to acknowledge it. You can see every delivery attempt with `GET /v1/webhook-subscriptions/{subscription_id}/deliveries`.

**Verify the signature.** Webhooks are signed following the [Standard Webhooks](https://www.standardwebhooks.com) specification, so you can use any Standard Webhooks library. To verify by hand:
1. Take the `webhook-id` and `webhook-timestamp` headers and the raw request body, exactly as received.
2. Build the signed content: `{webhook-id}.{webhook-timestamp}.{body}`.
3. Remove the `whsec_` prefix from your subscription's `signing_secret` and base64-decode the rest. That is your key.
4. Compute an HMAC-SHA256 of the signed content with the key, and base64-encode the result.
5. Compare `v1,<your result>` with the `webhook-signature` header using a constant-time comparison. The Standard Webhooks format allows several space-separated signatures in this header, so accept the request if any of them matches.

Also reject requests whose `webhook-timestamp` is more than about five minutes from your server's clock.

**Handle duplicates.** The same event can arrive more than once. `webhook-id` equals the body's `event_id` and stays the same for every delivery of an event, so use it to skip events you've already processed.




## OpenAPI

````yaml /api-reference/openapi.yaml webhook publicEvent
openapi: 3.1.0
info:
  title: Blujay API
  version: 1.0.0
  description: >-
    The Blujay API lets you send and receive iMessage, RCS and SMS messages from
    your

    Blujay phone numbers, manage contacts, and receive real-time webhooks.


    Every response uses the same JSON envelope and carries a `trace_id` you can
    share

    with support. Authenticate with your workspace API key.
servers:
  - url: https://api.blujay.io
    description: Production
security:
  - PublicApiKey: []
tags:
  - name: Auth
    description: Check which workspace and credential a request is using.
  - name: Chats
    description: >-
      Direct and group conversations between your Blujay numbers and your
      contacts.
  - name: Messages
    description: Send, read, edit, unsend and retry messages.
  - name: Phone Numbers
    description: >-
      Your Blujay numbers, whether each can send right now, and their live
      sending limits.
  - name: Capability
    description: >-
      Check whether a phone number can be reached by iMessage, RCS or SMS before
      you send.
  - name: Contacts
    description: Create, find, update, tag, assign and opt out contacts.
  - name: vCards
    description: >-
      Saved contact cards that you can send in a message. Recipients get a
      native contact card over iMessage, SMS or RCS.
  - name: Team Members
    description: People in your workspace you can assign contacts to.
  - name: Workflows
    description: Enroll contacts in workflows you start manually.
  - name: Attachments
    description: >-
      Upload files once and reuse them in messages, or download files from
      messages.
  - name: Webhooks
    description: Subscribe to events, inspect delivery attempts and verify signatures.
paths: {}
components:
  securitySchemes:
    PublicApiKey:
      type: http
      scheme: bearer
      bearerFormat: blu_...
      description: >
        Your workspace API key, sent as `Authorization: Bearer blu_...`.
        Workspace admins can find it in the Blujay app under **API**.


        An API key has full access to your workspace and works on every
        endpoint. There is no test mode: every key sends real messages and
        changes real data, so keep it secret and use it only from your server.


        Each API key can make 600 read requests and 120 write requests per
        minute, plus 60 attachment requests per minute. Over a limit you get
        `429 RATE_LIMIT_EXCEEDED` with `Retry-After`.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.