Webhooks

Webhooks are how a machine gets realtime: an API key cannot open a GraphQL subscription, so live updates always arrive as signed HTTP posts.

Manage the subscription with the webhook subscription operations - dashboard login only.

One Concept, Two Delivery Scopes

It is the same event catalogue, the same envelope, the same HMAC signing and the same retry policy either way. Only who receives what differs.

A tech provider registers once and never again as clients come and go - a new client org starts delivering to the same endpoint automatically.

Where Each Is Configured

The operator guide also covers inbound webhooks (an external system posting into Wexio to trigger a flow), which have nothing to do with the events below. The rest of this section describes the partner fan-out shape; a per-org webhook carries the same events with connectionId in place of partnerId/externalId.

Routing an Event

Each delivery carries two identifiers for the client it came from:

"meta": {
  "organisationId": "6716b2f0a1c34d0012ab89ef",
  "externalId": "crmco-client-5541",
  "partnerId": "6716b1001c34d0012ab89abc"
}

• organisationId - the Wexio client org.
• externalId - your ID for that client, as passed to createClientOrg. Set it at provisioning time and you never need a mapping table.
• partnerId - your own provider org. Constant across every delivery.

Event Catalogue

type on the wire uses the dotted lowercase form. The events argument of the subscription mutations uses the GraphQL enum name.

The flow Namespace

The catalogue also reserves FLOW, a namespace for events a flow author emits by hand from an Outbound Webhook Event card (flow.order_confirmed, flow.lead_qualified, …).

For a partner integration, the meaningful events are the system ones above: they fire automatically, with no setup inside the client org.

Minimum Viable Subscription

If you only want to mirror conversations into your own product, subscribe to these four:

mutation Register {
  registerPartnerWebhook(
    url: "https://api.crmco.com/wexio/webhook"
    events: [
      MESSAGE_INBOUND_CREATED
      MESSAGE_OUTBOUND_CREATED
      CONTACT_MERGED
      ORGANISATION_DELETED
    ]
  ) { id signingSecret }
}

If you send messages, add MESSAGE_OUTBOUND_STATUS as well - it is the only way to learn whether a message was delivered, and the only way to complete an async send.

CONTACT_MERGED matters more than it looks: without it, two contacts you mirrored separately can silently become one on Wexio's side and your copy drifts. ORGANISATION_DELETED tells you a client is gone.

Next

• Envelope & delivery - headers, signature verification, retries, deduplication.
• Shared types - the data payload shapes every event reuses.