Endpoint verification

Hub verifies ownership of your receiver URL independently of event signing. It sends an authenticated HTTPS POST with no body, Content-Type: application/json, and a fresh X-Validation-Token. Custom headers and configured receiver authorization also apply. This request has no event HMAC signature.

Destinations must resolve only to public addresses. Validation, event delivery and receiver OAuth token requests do not follow redirects or use environment proxies. Response bodies are limited to 256 KiB and outbound request bodies to 2 MiB. Keep your final HTTPS URL directly reachable within these limits.

Verification requires any 2xx response within 10 seconds whose response body contains the token. A plain-text 200 echo of the exact token is the simplest response. A JSON string containing it also works. A 204 with no body cannot satisfy the token requirement.

Use the combined receiver: authenticate the request first, handle the token on an empty body before event JSON parsing/HMAC checks, and never process a token request as an event. A token on a nonempty event body must not bypass event signing.

When it runs

Verification runs on creation, a changed endpoint, a changed authentication protocol, any supplied headers array, or active: true. A PATCH containing only the existing URL does not force verification. Success sets active and isVerified to true and sets verifiedAt; failure deactivates the webhook and clears verification.

After fixing authentication, DNS, TLS or the receiver, force a new verification:

curl -X PATCH 'https://app.chatt2.me/v1/organization/webhook/WEBHOOK_UUID' \
  -H 'x-api-key: YOUR_APPLICATION_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"active": true}'

Alternatively, retry an eligible failed validation log individually. Validation retry uses a new token, not the old request body, and can activate/verify the endpoint. Validation logs cannot be bulk retried. Check requestBody, messageId, status, responseBody and canRetry in logs.

A verified endpoint still needs an enabled channel subscription to receive normal events.