Outgoing webhooks

A webhook sends a request to a URL you choose when something happens in your workspace, for example a new comment. Your tool hears about it within seconds, so it does not have to keep asking the Public API. Webhooks come with every paid plan. Owners and admins set them up under Settings, in the Webhooks card.

Add an endpoint

1. Open Settings and find Webhooks.
2. Under New endpoint, give it a Name and the Endpoint URL. The URL must start with https://. Local and private addresses are refused.
3. Tick the Events you want, at least one.
4. Click Add endpoint, copy the Signing secret, and click I have copied it. The secret is shown only once.

A workspace can have up to 10 endpoints, counting the ones Zapier creates. This number may still change. An endpoint receives only events that happen after it is added, never older ones.

Events

Post scheduling is not open yet, so the two post events do not fire for now.

What arrives

Each event is a POST with a JSON body:

{
  "id": "comment:…",
  "type": "comment.received",
  "data": {
    "id": "…",
    "platform": "instagram",
    "accountId": "…",
    "authorName": "…",
    "text": "Is this still available?",
    "contentRef": "…",
    "origin": "…",
    "status": "pending",
    "occurredAt": "2026-10-21T08:15:00.000Z"
  }
}

The top-level id stays the same on every retry of one event. Store it and skip any id you have already handled, because a retry can bring the same event twice.

message.received carries id, conversationId, platform, accountId, text, origin, and occurredAt. The post events carry the post’s id, accountId, kind, text, status, scheduledAt, and either publishedAt or lastError.

The request also has these headers:

• X-VivaDialog-Event: the event type.
• X-VivaDialog-Delivery: the id of this delivery.
• X-VivaDialog-Timestamp: when it was sent, in Unix seconds.
• X-VivaDialog-Signature: t=<timestamp>,v1=<signature>.

Check the signature

The signature is an HMAC-SHA256, in hex, of the timestamp, a dot, and the raw request body, keyed with your signing secret. Check it before you trust the request, and refuse a timestamp more than 5 minutes old. In Node.js:

import { createHmac, timingSafeEqual } from "node:crypto";

function isValid(header, rawBody, secret) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const t = Number(parts.t);
  if (!parts.v1 || Math.abs(Date.now() / 1000 - t) > 300) return false;
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest();
  const given = Buffer.from(parts.v1, "hex");
  return given.length === expected.length && timingSafeEqual(given, expected);
}

Use the body exactly as it arrived. Parsing the JSON and turning it back into text can change it, and the check then fails.

Retries

Your endpoint has 10 seconds to answer with a 2xx status. Anything else counts as a failure, including a redirect, which is not followed. A failed delivery is tried again after 1 minute, 5 minutes, 30 minutes, 2 hours, and 6 hours. After six attempts it is marked Failed. The retry schedule may still change.

The delivery log

Under Deliveries you see recent deliveries, newest first, with the event, the endpoint, the status, the number of attempts, and your endpoint’s response. Filter by Queued, Retrying, Delivered, or Failed. The log keeps 30 days. A failed delivery can be sent again with Send again for 7 days; after that its content is gone. Once a delivery succeeds, VivaDialog drops its copy of the comment or message text.

Pause, new secret, delete

• Pause stops deliveries to the endpoint, and deliveries already waiting are marked failed. Resume starts it again.
• New secret replaces the signing secret. The old one stops working with the next delivery, so update your receiver first.
• Delete removes the endpoint and its delivery log.

To change an endpoint’s URL or events, delete it and add it again.

If the workspace turns read-only or the plan ends, deliveries stop and waiting ones are marked failed. See the free trial and read-only mode.