> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bodyguard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhook configuration

> Configure the URL, events, signing secret, and contacts of a Bodyguard webhook, and understand webhook statuses.

This page describes the fields you set when you register a webhook in the dashboard (**Settings** > **Webhooks** > **Add webhook +**).

## Endpoint URL

The URL that receives notifications. It must be a public `https` URL with a valid TLS certificate that is not self-signed. Bodyguard denies webhooks registered with an `http` URL.

## Events

A webhook is triggered by one or more events that you subscribe to:

| Event type | Triggered when |
| - | - |
| [`message.updated`](https://docs.bodyguard.ai/en/api-reference/reference/webhooks/payloads#message-updated) | A Message is updated within a Channel. |
| [`author.updated`](https://docs.bodyguard.ai/en/api-reference/reference/webhooks/payloads#author-updated) | The status of an Author changes within a Source. |

One webhook can subscribe to several events. You can also add another webhook with a different URL to handle other events separately.

> [!NOTE]
>
> Bodyguard also sends a [`webhook.validate`](https://docs.bodyguard.ai/en/api-reference/reference/webhooks/payloads#webhook-validate) event, which you cannot subscribe to. Your endpoint must answer it with a `2xx` status code when you create the webhook or change its URL.

For the content of each event, see [Payloads](https://docs.bodyguard.ai/en/api-reference/reference/webhooks/payloads.md).

## Signing secret

Bodyguard generates a signing secret for each webhook. It starts with `whsec_` followed by a base64-encoded value. The dashboard displays it only once, when you create the webhook, so copy it then. See [Connect your webhook](https://docs.bodyguard.ai/en/documentation/how-to/connect-webhook.md).

Bodyguard uses it to sign every request, and you use it to verify that a request comes from Bodyguard and was not altered. See [Quick start](https://docs.bodyguard.ai/en/api-reference/webhooks/quick-start.md).

> [!WARNING]
>
> Treat the signing secret like a password. Store it in a secrets manager or an environment variable, and never expose it in client-side code.

## Contacts

Each new webhook requires at least one contact. Bodyguard sends alerts to every contact if it encounters issues reaching your endpoint, such as the emails described in [Handling errors](https://docs.bodyguard.ai/en/api-reference/webhooks/handling-errors.md#emails).

Each contact must be a user registered to your organization on the dashboard.

## Webhook statuses

Each webhook has a status that describes its current state:

| Status | Description |
| - | - |
| `ENABLED` | The webhook is active and ready to receive notifications. |
| `DISABLED` | The webhook is inactive and notifications are not sent. You can set this value from the dashboard. |
| `ERROR` | The webhook is in error and notifications are not sent. Bodyguard attempted to notify your endpoint multiple times without success. |

The `ERROR` status is set automatically. While a webhook is `DISABLED` or `ERROR`, Bodyguard doesn't send its events, and they can't be replayed when you enable the webhook again. To enable a webhook in error, fix the issue, then enable it manually from the dashboard. See [Handling errors](https://docs.bodyguard.ai/en/api-reference/webhooks/handling-errors.md).

## Next steps

> [card] [Payloads](https://docs.bodyguard.ai/en/api-reference/reference/webhooks/payloads.md)
>
> Headers, payload structure, and an example for each event type.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.