WeHub
מעבר לעבריתSign inStart a trial

For developers

A public API per business, and signed outgoing events. The same locks and limits that govern the interface govern these too.

Public API

A key is created in the business settings, carries an identifying prefix and is limited to the scopes you choose. Sending passes the same gates as sending from the inbox: the 24-hour window, plan limits and the outbound checks.

  • Contacts: create, read, update, look up by identity.
  • Conversations: list, read, change status and assignment.
  • Messages: send, including Meta templates and media.
  • Manage the outgoing webhooks through the API itself.
curl https://api.wehub.co.il/api/v1/public/messages \
  -H "Authorization: Bearer wh_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "channel": "whatsapp",
    "to": "+972521234567",
    "text": "ההזמנה יצאה למשלוח"
  }'

Outgoing webhooks

Each event is delivered as a POST carrying an HMAC-SHA256 signature and a timestamp. If the endpoint does not answer there are five retries at growing intervals, plus a delivery log on the integrations screen.

The events

  • message.receivedMessage received
  • message.sentMessage sent
  • conversation.openedConversation opened
  • conversation.assignedConversation assigned
  • conversation.closedConversation closed
  • csat.receivedSatisfaction score received
  • call.endedCall ended

Verifying the signature

Compare in constant time. A timestamp older than 5 minutes is rejected.

const signed = `${timestamp}.${rawBody}`;
const expected = crypto
  .createHmac('sha256', webhookSecret)
  .update(signed)
  .digest('hex');

crypto.timingSafeEqual(
  Buffer.from(expected),
  Buffer.from(req.header('X-Wehub-Signature')),
);

The full documentation

The OpenAPI spec, a Postman collection and a test-connection button live inside the account, so you work against the real keys of the business.

Docs inside the account

Your own integration card

If all you want is to show data from your system inside a conversation, you do not need the API. Configure one URL, receive a signed POST with the contact identity, and return JSON.

Connect your first channel today

The wizard creates the business, connects a channel and invites the team. It ends by having you message yourself and watch it land.

Start a trialTalk to us