[{"data":1,"prerenderedAt":1412},["ShallowReactive",2],{"search-de":3,"content-de-api\u002Finbound-channels":4,"surround-de-\u002Fapi\u002Finbound-channels":1405},[],{"id":5,"title":6,"body":7,"description":1398,"extension":1399,"meta":1400,"navigation":415,"path":1401,"seo":1402,"stem":1403,"__hash__":1404},"content_de\u002F2.api\u002F13.inbound-channels.md","Webhooks für eingehende Kanäle",{"type":8,"value":9,"toc":1383},"minimark",[10,19,47,52,63,66,156,178,188,192,195,282,294,297,370,381,423,426,437,444,448,458,463,537,548,555,624,634,638,655,697,717,726,730,733,808,811,923,943,1021,1025,1039,1042,1162,1165,1251,1262,1266,1294,1298,1317,1321,1343,1366,1370,1374,1379],[11,12,13,14,18],"p",{},"Dies sind die Server-zu-Server-Webhook-Endpunkte, die Kundennachrichten außerhalb von E-Mail nach Owlat einspeisen. Jeder von ihnen nimmt ein eingehendes Payload eines externen Anbieters (Twilio, Meta oder Ihres eigenen Systems) entgegen, verifiziert es kryptografisch und wandelt es in eine Nachricht des vereinheitlichten Posteingangs um. Sie gehören nicht zur authentifizierten ",[15,16,17],"code",{},"\u002Fapi\u002Fv1\u002F*","-Oberfläche und werden nicht aus einem Browser aufgerufen — Sie konfigurieren sie im Dashboard des Anbieters, und dieser postet direkt an Ihr Deployment.",[20,21,24],"callout",{"title":22,"type":23},"Nur eingehend","info",[11,25,26,27,31,32,36,37,40,41,46],{},"Diese Endpunkte nehmen ",[28,29,30],"strong",{},"eingehende"," Nachrichten entgegen. Der ausgehende Versand über SMS\u002FWhatsApp\u002FGeneric ",[33,34,35],"em",{},"ist"," durchgängig verdrahtet (echte Twilio-\u002FMeta-\u002FWebhook-Adapter) und wird über den Antwortpfad des KI-Agenten, die ",[28,38,39],{},"Antworten","-Schaltfläche pro Nachricht in der Thread-Ansicht des Team-Posteingangs oder einen manuellen Versand aus der vereinheitlichten Zeitleiste eines Kontakts erreicht. Unter ",[42,43,45],"a",{"href":44},"\u002Fguide\u002Fchannels","Kommunikationskanäle"," sehen Sie, was jeder Kanal heute leisten kann. Diese Seite behandelt die Empfangsseite.",[48,49,51],"h2",{"id":50},"überblick-wie-eingehende-kanäle-den-vereinheitlichten-posteingang-speisen","Überblick: Wie eingehende Kanäle den vereinheitlichten Posteingang speisen",[11,53,54,55,58,59,62],{},"Alle drei Kanal-Webhooks nutzen dieselbe Pipeline (",[15,56,57],{},"apps\u002Fapi\u002Fconvex\u002Fwebhooks\u002Fpipeline.ts","). Die Hülle ist für jeden Anbieter identisch; nur Signaturprüfung und Payload-Parsing unterscheiden sich, und diese liegen in anbieterspezifischen Adaptern unter ",[15,60,61],{},"apps\u002Fapi\u002Fconvex\u002Fwebhooks\u002Fadapters\u002F",".",[11,64,65],{},"Die Pipeline führt diese Schritte der Reihe nach aus:",[67,68,69,83,101,111,117,135],"ol",{},[70,71,72,79,80,62],"li",{},[28,73,74,75,78],{},"Nicht-",[15,76,77],{},"POST"," ablehnen"," mit ",[15,81,82],{},"405",[70,84,85,88,89,92,93,96,97,100],{},[28,86,87],{},"Rate-Limiting nach Client-IP"," (",[15,90,91],{},"webhookIngestion",": Token-Bucket, 50\u002FSek., Burst-Kapazität 100). Über dem Limit wird ",[15,94,95],{},"429"," mit einem ",[15,98,99],{},"Retry-After","-Header zurückgeliefert.",[70,102,103,106,107,62],{},[28,104,105],{},"Signatur verifizieren"," über den Provider-Adapter. Fail-closed — siehe ",[42,108,110],{"href":109},"#required-env-secrets-and-fail-closed-behavior","Erforderliche Env-Secrets",[70,112,113,116],{},[28,114,115],{},"Rohes Payload revisionssicher speichern"," (Best-Effort; lässt die Anfrage nie scheitern).",[70,118,119,122,123,126,127,130,131,134],{},[28,120,121],{},"Payload parsen"," in ein normalisiertes ",[15,124,125],{},"channel.received","-Ereignis. Ein Parse-Fehler liefert ",[15,128,129],{},"400","; ein Payload ohne verwertbare Nachricht (z. B. ein Meta-Statusupdate) wird mit ",[15,132,133],{},"200 { \"success\": true, \"ignored\": true }"," quittiert.",[70,136,137,140,141,144,145,147,148,151,152,155],{},[28,138,139],{},"Ereignis dispatchen."," Der Dispatcher (",[15,142,143],{},"apps\u002Fapi\u002Fconvex\u002Fwebhooks\u002Fdispatcher.ts",") leitet ",[15,146,125],{}," an die interne Mutation ",[15,149,150],{},"processInboundChannel"," weiter, die den Kontakt auflöst oder anlegt, den Konversations-Thread findet oder wieder öffnet und eine eingehende Zeile in ",[15,153,154],{},"unifiedMessages"," einfügt.",[11,157,158,159,162,163,166,167,170,171,174,175,177],{},"Kontakte werden pro Kanal aufgelöst, nicht per E-Mail: Eine eingehende SMS- oder WhatsApp-Nachricht legt über ",[15,160,161],{},"contactIdentities"," einen Kontakt an, der auf die Telefonnummer oder das Handle des Absenders geschlüsselt ist; diese Kontakte haben keine ",[15,164,165],{},"email",". Jeder Kanal bildet seinen eigenen Identitäts-Schlüsselraum — ein ",[15,168,169],{},"john@example.com"," im ",[15,172,173],{},"generic","-Kanal ist ein anderer Kontakt als einer im ",[15,176,165],{},"-Kanal. Die kanalübergreifende Vereinheitlichung ist eine explizite Merge-Operation und erfolgt nicht automatisch.",[20,179,181],{"title":180,"type":23},"Basis-URL",[11,182,183,184,187],{},"Alle nachfolgenden Pfade sind relativ zur HTTP-URL Ihres Deployments, z. B. ",[15,185,186],{},"https:\u002F\u002F\u003Cyour-deployment>.convex.site\u002Fwebhooks\u002Fsms",". Tragen Sie diese vollständige URL in den Webhook-Einstellungen des Anbieters ein.",[48,189,191],{"id":190},"post-webhookssms-twilio","POST \u002Fwebhooks\u002Fsms (Twilio)",[11,193,194],{},"Eingehende SMS aus dem Programmable-Messaging-Webhook von Twilio.",[196,197,198,211],"table",{},[199,200,201],"thead",{},[202,203,204,208],"tr",{},[205,206,207],"th",{},"Eigenschaft",[205,209,210],{},"Wert",[212,213,214,224,235,245,253,267],"tbody",{},[202,215,216,220],{},[217,218,219],"td",{},"Methode",[217,221,222],{},[15,223,77],{},[202,225,226,229],{},[217,227,228],{},"Content-Type",[217,230,231,234],{},[15,232,233],{},"application\u002Fx-www-form-urlencoded"," (Twilio-Standard)",[202,236,237,240],{},[217,238,239],{},"Signatur-Header",[217,241,242],{},[15,243,244],{},"X-Twilio-Signature",[202,246,247,250],{},[217,248,249],{},"Signaturverfahren",[217,251,252],{},"HMAC-SHA1, Base64-kodiert",[202,254,255,258],{},[217,256,257],{},"Secret",[217,259,260,263,264],{},[28,261,262],{},"Auth Token"," des SMS-Kanals, sonst ",[15,265,266],{},"TWILIO_AUTH_TOKEN",[202,268,269,272],{},[217,270,271],{},"Erfolgsantwort",[217,273,274,275,88,278,281],{},"Leeres TwiML ",[15,276,277],{},"\u003CResponse>\u003C\u002FResponse>",[15,279,280],{},"text\u002Fxml",")",[11,283,284,285,287,288,62],{},"Der Adapter rekonstruiert Twilios kanonische Validierungszeichenkette — die vollständige Request-URL, gefolgt von allen Formularparametern in alphabetischer Reihenfolge aneinandergehängt (Schlüssel unmittelbar gefolgt vom Wert, ohne Trennzeichen) — und vergleicht dann den HMAC-SHA1 in konstanter Zeit mit ",[15,286,244],{},". Das entspricht ",[42,289,293],{"href":290,"rel":291},"https:\u002F\u002Fwww.twilio.com\u002Fdocs\u002Fusage\u002Fsecurity#validating-requests",[292],"nofollow","Twilios Spezifikation zur Request-Validierung",[11,295,296],{},"Geparste Felder:",[196,298,299,309],{},[199,300,301],{},[202,302,303,306],{},[205,304,305],{},"Formularfeld",[205,307,308],{},"Zugeordnet zu",[212,310,311,321,331,343,353],{},[202,312,313,318],{},[217,314,315],{},[15,316,317],{},"From",[217,319,320],{},"Absenderkennung (erforderlich)",[202,322,323,328],{},[217,324,325],{},[15,326,327],{},"Body",[217,329,330],{},"Nachrichtentext (erforderlich)",[202,332,333,338],{},[217,334,335],{},[15,336,337],{},"MessageSid",[217,339,340],{},[15,341,342],{},"externalMessageId",[202,344,345,350],{},[217,346,347],{},[15,348,349],{},"MediaUrl0",[217,351,352],{},"erste Medien-URL (optional)",[202,354,355,367],{},[217,356,357,360,361,360,364],{},[15,358,359],{},"FromCity",", ",[15,362,363],{},"FromState",[15,365,366],{},"FromCountry",[217,368,369],{},"als Metadaten gespeichert",[11,371,372,373,375,376,378,379,62],{},"Fehlt ",[15,374,317],{}," oder ",[15,377,327],{},", schlägt das Parsen fehl und der Endpunkt liefert ",[15,380,129],{},[382,383,388],"pre",{"className":384,"code":385,"language":386,"meta":387,"style":387},"language-txt shiki shiki-themes github-light github-dark-dimmed","POST \u002Fwebhooks\u002Fsms\nX-Twilio-Signature: \u003Cbase64 HMAC-SHA1>\nContent-Type: application\u002Fx-www-form-urlencoded\n\nFrom=%2B15551234567&Body=Hello&MessageSid=SM123&FromCity=Berlin\n","txt","",[15,389,390,398,404,410,417],{"__ignoreMap":387},[391,392,395],"span",{"class":393,"line":394},"line",1,[391,396,397],{},"POST \u002Fwebhooks\u002Fsms\n",[391,399,401],{"class":393,"line":400},2,[391,402,403],{},"X-Twilio-Signature: \u003Cbase64 HMAC-SHA1>\n",[391,405,407],{"class":393,"line":406},3,[391,408,409],{},"Content-Type: application\u002Fx-www-form-urlencoded\n",[391,411,413],{"class":393,"line":412},4,[391,414,416],{"emptyLinePlaceholder":415},true,"\n",[391,418,420],{"class":393,"line":419},5,[391,421,422],{},"From=%2B15551234567&Body=Hello&MessageSid=SM123&FromCity=Berlin\n",[11,424,425],{},"Bei Erfolg erhält Twilio den TwiML-Envelope mit leerer Response (von diesem Endpunkt wird keine automatische Antwort gesendet):",[382,427,431],{"className":428,"code":429,"language":430,"meta":387,"style":387},"language-xml shiki shiki-themes github-light github-dark-dimmed","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\u003CResponse>\u003C\u002FResponse>\n","xml",[15,432,433],{"__ignoreMap":387},[391,434,435],{"class":393,"line":394},[391,436,429],{},[20,438,441],{"title":439,"type":440},"Kein Replay-Schutz","warning",[11,442,443],{},"Twilio nimmt keinen Zeitstempel in seine Signatur auf, daher kann diese Schicht Replays nicht erkennen. Der schlimmste Fall ist eine doppelte eingehende Nachricht, kein gefälschter Zustandsübergang — für einen eingehenden Kanal akzeptabel, verwenden Sie dieses Verfahren aber nicht für irgendetwas, das Abrechnung oder Authentifizierung verändert.",[48,445,447],{"id":446},"post-und-get-webhookswhatsapp-meta-verifizierungs-challenge","POST und GET \u002Fwebhooks\u002Fwhatsapp (Meta-Verifizierungs-Challenge)",[11,449,450,451,453,454,457],{},"WhatsApp-Business-Nachrichten kommen über Metas Cloud API. Derselbe Pfad bedient zwei Methoden: ",[15,452,77],{}," für eingehende Nachrichten und ",[15,455,456],{},"GET"," für die einmalige Verifizierungs-Challenge des Abonnements.",[459,460,462],"h3",{"id":461},"post-eingehende-nachricht","POST — eingehende Nachricht",[196,464,465,473],{},[199,466,467],{},[202,468,469,471],{},[205,470,207],{},[205,472,210],{},[212,474,475,483,492,501,511,524],{},[202,476,477,479],{},[217,478,219],{},[217,480,481],{},[15,482,77],{},[202,484,485,487],{},[217,486,228],{},[217,488,489],{},[15,490,491],{},"application\u002Fjson",[202,493,494,496],{},[217,495,239],{},[217,497,498],{},[15,499,500],{},"X-Hub-Signature-256",[202,502,503,505],{},[217,504,249],{},[217,506,507,508],{},"HMAC-SHA256 über den rohen Body, hex-kodiert, mit Präfix ",[15,509,510],{},"sha256=",[202,512,513,515],{},[217,514,257],{},[217,516,517,520,521],{},[28,518,519],{},"App Secret"," des WhatsApp-Kanals, sonst ",[15,522,523],{},"META_APP_SECRET",[202,525,526,528],{},[217,527,271],{},[217,529,530,533,534,281],{},[15,531,532],{},"200 OK"," (Klartext-Body ",[15,535,536],{},"OK",[11,538,539,540,542,543,62],{},"Der Adapter entfernt das Präfix ",[15,541,510],{}," aus dem Header und vergleicht den hex-kodierten HMAC-SHA256 des rohen Bodys in konstanter Zeit, gemäß ",[42,544,547],{"href":545,"rel":546},"https:\u002F\u002Fdevelopers.facebook.com\u002Fdocs\u002Fwhatsapp\u002Fcloud-api\u002Fwebhooks",[292],"Metas Webhook-Dokumentation",[11,549,550,551,554],{},"Er liest die erste Nachricht aus dem verschachtelten Envelope ",[15,552,553],{},"entry[0].changes[0].value.messages[0]",":",[196,556,557,566],{},[199,558,559],{},[202,560,561,564],{},[205,562,563],{},"Quellfeld",[205,565,308],{},[212,567,568,577,587,598,611],{},[202,569,570,575],{},[217,571,572],{},[15,573,574],{},"messages[0].from",[217,576,320],{},[202,578,579,584],{},[217,580,581],{},[15,582,583],{},"messages[0].text.body",[217,585,586],{},"Nachrichtentext",[202,588,589,594],{},[217,590,591],{},[15,592,593],{},"messages[0].id",[217,595,596],{},[15,597,342],{},[202,599,600,608],{},[217,601,602,375,605],{},[15,603,604],{},"messages[0].image.url",[15,606,607],{},"document.url",[217,609,610],{},"Medien-URL (optional)",[202,612,613,618],{},[217,614,615],{},[15,616,617],{},"contacts[0].profile.name",[217,619,620,621,281],{},"als Metadaten gespeichert (",[15,622,623],{},"profileName",[11,625,626,627,630,631,633],{},"Meta postet außerdem Zustell-\u002FLesestatus-Updates, die keine ",[15,628,629],{},"messages"," enthalten. Diese werden mit ",[15,632,133],{}," quittiert und erzeugen keine Posteingangsnachricht.",[459,635,637],{"id":636},"get-verifizierungs-challenge","GET — Verifizierungs-Challenge",[11,639,640,641,643,644,360,647,650,651,654],{},"Wenn Sie ein Webhook-Abonnement aktivieren, sendet Meta eine ",[15,642,456],{},"-Anfrage mit den Query-Parametern ",[15,645,646],{},"hub.mode",[15,648,649],{},"hub.verify_token"," und ",[15,652,653],{},"hub.challenge",". Der Handler läuft außerhalb der Reihe, vor der Inbound-Pipeline:",[656,657,658,672,691],"ul",{},[70,659,660,661,664,665,668,669,62],{},"Ist weder der ",[28,662,663],{},"Verify Token"," des WhatsApp-Kanals noch ",[15,666,667],{},"META_VERIFY_TOKEN"," gesetzt, liefert er ",[15,670,671],{},"503",[70,673,674,675,677,678,681,682,684,685,79,687,690],{},"Ist ",[15,676,646],{}," gleich ",[15,679,680],{},"subscribe"," und stimmt ",[15,683,649],{}," mit dem konfigurierten Token überein (Vergleich in konstanter Zeit), gibt er ",[15,686,653],{},[15,688,689],{},"200"," zurück.",[70,692,693,694,62],{},"Andernfalls liefert er ",[15,695,696],{},"403 Verification failed",[382,698,700],{"className":384,"code":699,"language":386,"meta":387,"style":387},"GET \u002Fwebhooks\u002Fwhatsapp?hub.mode=subscribe&hub.verify_token=\u003Cyour-token>&hub.challenge=12345\n→ 200\n12345\n",[15,701,702,707,712],{"__ignoreMap":387},[391,703,704],{"class":393,"line":394},[391,705,706],{},"GET \u002Fwebhooks\u002Fwhatsapp?hub.mode=subscribe&hub.verify_token=\u003Cyour-token>&hub.challenge=12345\n",[391,708,709],{"class":393,"line":400},[391,710,711],{},"→ 200\n",[391,713,714],{"class":393,"line":406},[391,715,716],{},"12345\n",[11,718,719,720,722,723,725],{},"Setzen Sie den ",[28,721,663],{}," des WhatsApp-Kanals (Einstellungen → Kanäle) — oder ",[15,724,667],{}," — auf eine beliebige Zeichenkette Ihrer Wahl und tragen Sie denselben Wert in Metas Webhook-Konfiguration als Verify-Token ein.",[48,727,729],{"id":728},"post-webhookschannel-generischer-shared-secret-envelope","POST \u002Fwebhooks\u002Fchannel (generischer Shared-Secret-Envelope)",[11,731,732],{},"Ein anbieterunabhängiger Endpunkt, um Nachrichten aus jedem System einzuspeisen, das JSON mit einem Shared Secret posten kann. Dies ist der Kanal mit dem geringsten Vertrauensniveau — er nutzt ein statisches Shared Secret statt eines HMAC pro Anfrage, daher ist das IP-Rate-Limit der Pipeline Ihre wichtigste Missbrauchskontrolle.",[196,734,735,743],{},[199,736,737],{},[202,738,739,741],{},[205,740,207],{},[205,742,210],{},[212,744,745,753,761,778,786,799],{},[202,746,747,749],{},[217,748,219],{},[217,750,751],{},[15,752,77],{},[202,754,755,757],{},[217,756,228],{},[217,758,759],{},[15,760,491],{},[202,762,763,766],{},[217,764,765],{},"Auth-Header",[217,767,768,360,771,774,775],{},[15,769,770],{},"X-Webhook-Secret",[28,772,773],{},"oder"," ",[15,776,777],{},"Authorization: Bearer \u003Csecret>",[202,779,780,783],{},[217,781,782],{},"Auth-Verfahren",[217,784,785],{},"Zeichenkettenvergleich in konstanter Zeit",[202,787,788,790],{},[217,789,257],{},[217,791,792,795,796],{},[28,793,794],{},"Secret Key"," des Generic-Webhook-Kanals, sonst ",[15,797,798],{},"GENERIC_WEBHOOK_SECRET",[202,800,801,803],{},[217,802,271],{},[217,804,805],{},[15,806,807],{},"200 { \"success\": true, \"kind\": \"channel.received\" }",[11,809,810],{},"Der JSON-Envelope ist nachsichtig — Felder greifen auf mehrere Aliase zurück:",[196,812,813,825],{},[199,814,815],{},[202,816,817,820,823],{},[205,818,819],{},"Envelope-Feld",[205,821,822],{},"Aliase \u002F Fallback",[205,824,308],{},[212,826,827,846,863,878,893,910],{},[202,828,829,834,843],{},[217,830,831],{},[15,832,833],{},"from",[217,835,836,839,840],{},[15,837,838],{},"sender",", sonst wörtlich ",[15,841,842],{},"\"webhook\"",[217,844,845],{},"Absenderkennung",[202,847,848,853,861],{},[217,849,850],{},[15,851,852],{},"text",[217,854,855,360,858],{},[15,856,857],{},"message",[15,859,860],{},"content.text",[217,862,586],{},[202,864,865,870,875],{},[217,866,867],{},[15,868,869],{},"html",[217,871,872],{},[15,873,874],{},"content.html",[217,876,877],{},"HTML-Body (optional)",[202,879,880,885,890],{},[217,881,882],{},[15,883,884],{},"subject",[217,886,887],{},[15,888,889],{},"content.subject",[217,891,892],{},"Betreff (optional)",[202,894,895,900,905],{},[217,896,897],{},[15,898,899],{},"id",[217,901,902],{},[15,903,904],{},"messageId",[217,906,907,909],{},[15,908,342],{}," (optional)",[202,911,912,917,920],{},[217,913,914],{},[15,915,916],{},"metadata",[217,918,919],{},"—",[217,921,922],{},"Objekt aus String-Werten (optional)",[382,924,926],{"className":384,"code":925,"language":386,"meta":387,"style":387},"POST \u002Fwebhooks\u002Fchannel\nX-Webhook-Secret: \u003Cyour-secret>\nContent-Type: application\u002Fjson\n",[15,927,928,933,938],{"__ignoreMap":387},[391,929,930],{"class":393,"line":394},[391,931,932],{},"POST \u002Fwebhooks\u002Fchannel\n",[391,934,935],{"class":393,"line":400},[391,936,937],{},"X-Webhook-Secret: \u003Cyour-secret>\n",[391,939,940],{"class":393,"line":406},[391,941,942],{},"Content-Type: application\u002Fjson\n",[382,944,948],{"className":945,"code":946,"language":947,"meta":387,"style":387},"language-json shiki shiki-themes github-light github-dark-dimmed","{\n  \"from\": \"user-42\",\n  \"text\": \"Hi, is anyone there?\",\n  \"id\": \"ext-9001\",\n  \"metadata\": { \"source\": \"intercom\" }\n}\n","json",[15,949,950,956,972,984,996,1015],{"__ignoreMap":387},[391,951,952],{"class":393,"line":394},[391,953,955],{"class":954},"sYgZi","{\n",[391,957,958,962,965,969],{"class":393,"line":400},[391,959,961],{"class":960},"snmFh","  \"from\"",[391,963,964],{"class":954},": ",[391,966,968],{"class":967},"s-HuK","\"user-42\"",[391,970,971],{"class":954},",\n",[391,973,974,977,979,982],{"class":393,"line":406},[391,975,976],{"class":960},"  \"text\"",[391,978,964],{"class":954},[391,980,981],{"class":967},"\"Hi, is anyone there?\"",[391,983,971],{"class":954},[391,985,986,989,991,994],{"class":393,"line":412},[391,987,988],{"class":960},"  \"id\"",[391,990,964],{"class":954},[391,992,993],{"class":967},"\"ext-9001\"",[391,995,971],{"class":954},[391,997,998,1001,1004,1007,1009,1012],{"class":393,"line":419},[391,999,1000],{"class":960},"  \"metadata\"",[391,1002,1003],{"class":954},": { ",[391,1005,1006],{"class":960},"\"source\"",[391,1008,964],{"class":954},[391,1010,1011],{"class":967},"\"intercom\"",[391,1013,1014],{"class":954}," }\n",[391,1016,1018],{"class":393,"line":1017},6,[391,1019,1020],{"class":954},"}\n",[48,1022,1024],{"id":1023},"erforderliche-secrets-und-fail-closed-verhalten","Erforderliche Secrets und Fail-closed-Verhalten",[11,1026,1027,1028,1031,1032,1035,1036,1038],{},"Jeder Adapter löst sein Secret aus den Zugangsdaten auf, die in der eigenen Konfigurationszeile des Kanals hinterlegt sind (",[28,1029,1030],{},"Einstellungen → Kanäle","), und weicht auf die Umgebungsvariable des Deployments aus, wenn der Kanal keine solche Zugangsdaten besitzt. Ist ",[28,1033,1034],{},"keines"," von beiden gesetzt, lehnt der Endpunkt mit ",[15,1037,671],{}," ab — er akzeptiert niemals „vorläufig“ eine unsignierte Anfrage.",[11,1040,1041],{},"Die Rangfolge ist relevant, wenn beides existiert: Der im Kanalformular eingetragene Wert gewinnt, sodass eine Secret-Rotation dort wirksam wird, ohne das Deployment anzufassen.",[196,1043,1044,1063],{},[199,1045,1046],{},[202,1047,1048,1051,1054,1057,1060],{},[205,1049,1050],{},"Endpunkt",[205,1052,1053],{},"Kanal-Zugangsdaten",[205,1055,1056],{},"Env-Fallback",[205,1058,1059],{},"Beides fehlt →",[205,1061,1062],{},"Falsche\u002Ffehlende Signatur →",[212,1064,1065,1090,1114,1138],{},[202,1066,1067,1072,1077,1081,1085],{},[217,1068,1069],{},[15,1070,1071],{},"POST \u002Fwebhooks\u002Fsms",[217,1073,1074,1075],{},"SMS ",[28,1076,262],{},[217,1078,1079],{},[15,1080,266],{},[217,1082,1083],{},[15,1084,671],{},[217,1086,1087],{},[15,1088,1089],{},"401",[202,1091,1092,1097,1102,1106,1110],{},[217,1093,1094],{},[15,1095,1096],{},"POST \u002Fwebhooks\u002Fwhatsapp",[217,1098,1099,1100],{},"WhatsApp ",[28,1101,519],{},[217,1103,1104],{},[15,1105,523],{},[217,1107,1108],{},[15,1109,671],{},[217,1111,1112],{},[15,1113,1089],{},[202,1115,1116,1121,1125,1129,1133],{},[217,1117,1118],{},[15,1119,1120],{},"GET \u002Fwebhooks\u002Fwhatsapp",[217,1122,1099,1123],{},[28,1124,663],{},[217,1126,1127],{},[15,1128,667],{},[217,1130,1131],{},[15,1132,671],{},[217,1134,1135],{},[15,1136,1137],{},"403",[202,1139,1140,1145,1150,1154,1158],{},[217,1141,1142],{},[15,1143,1144],{},"POST \u002Fwebhooks\u002Fchannel",[217,1146,1147,1148],{},"Generic ",[28,1149,794],{},[217,1151,1152],{},[15,1153,798],{},[217,1155,1156],{},[15,1157,671],{},[217,1159,1160],{},[15,1161,1089],{},[11,1163,1164],{},"Übliche Statuscodes in der gesamten Kanal-Pipeline:",[196,1166,1167,1177],{},[199,1168,1169],{},[202,1170,1171,1174],{},[205,1172,1173],{},"Status",[205,1175,1176],{},"Bedeutung",[212,1178,1179,1192,1201,1210,1219,1231,1242],{},[202,1180,1181,1185],{},[217,1182,1183],{},[15,1184,689],{},[217,1186,1187,1188,1191],{},"Angenommen (oder ",[15,1189,1190],{},"ignored: true"," bei einem Payload ohne Nachricht)",[202,1193,1194,1198],{},[217,1195,1196],{},[15,1197,129],{},[217,1199,1200],{},"Body konnte nicht gelesen oder geparst werden",[202,1202,1203,1207],{},[217,1204,1205],{},[15,1206,1089],{},[217,1208,1209],{},"Fehlende oder ungültige Signatur \u002F fehlendes Shared Secret",[202,1211,1212,1216],{},[217,1213,1214],{},[15,1215,1137],{},[217,1217,1218],{},"Meta-Verifizierungs-Challenge fehlgeschlagen (nur GET)",[202,1220,1221,1225],{},[217,1222,1223],{},[15,1224,82],{},[217,1226,1227,1228,1230],{},"Andere Methode als ",[15,1229,77],{}," (Kanal-Endpunkte)",[202,1232,1233,1237],{},[217,1234,1235],{},[15,1236,95],{},[217,1238,1239,1240],{},"Rate-limitiert; beachten Sie ",[15,1241,99],{},[202,1243,1244,1248],{},[217,1245,1246],{},[15,1247,671],{},[217,1249,1250],{},"Endpunkt nicht konfiguriert — erforderliches Secret ist nicht gesetzt",[11,1252,1253,1254,1257,1258,62],{},"Setzen Sie diese mit ",[15,1255,1256],{},"convex env set"," (oder über die Umgebungskonfiguration Ihres Deployments). Die vollständige Übersicht finden Sie unter ",[42,1259,1261],{"href":1260},"\u002Fdeveloper\u002Fenvironment-variables","Umgebungsvariablen",[48,1263,1265],{"id":1264},"eingehende-mta-routen","Eingehende MTA-Routen",[11,1267,1268,1269,1272,1273,1276,1277,1280,1281,1284,1285,1287,1288,1290,1291,1293],{},"Zwei weitere Webhooks liegen im selben HTTP-Router, sind aber Callbacks des mitgelieferten Mail Transfer Agents und der IMAP-Dienste und keine Kundenkanäle. Sie authentifizieren sich mit einer HMAC-SHA256-Signatur, die auf ",[15,1270,1271],{},"MTA_WEBHOOK_SECRET"," geschlüsselt ist und als ",[15,1274,1275],{},"X-MTA-Signature"," über die Zeichenkette ",[15,1278,1279],{},"\u003Ctimestamp>.\u003Cbody>"," gesendet wird, wobei der Zeitstempel in ",[15,1282,1283],{},"X-MTA-Timestamp"," steht. Beide lehnen ab, wenn ",[15,1286,1271],{}," nicht gesetzt ist (",[15,1289,671],{},"), und weisen einen veralteten oder fehlenden Zeitstempel zurück (",[15,1292,1089],{},").",[459,1295,1297],{"id":1296},"post-webhooksmta-mailbox","POST \u002Fwebhooks\u002Fmta-mailbox",[11,1299,1300,1301,1304,1305,1308,1309,1312,1313,62],{},"Eingehende Zustellung persönlicher E-Mail (Postbox) vom MTA — zu unterscheiden vom Bounce-\u002FBeschwerde-Callback unter ",[15,1302,1303],{},"POST \u002Fwebhooks\u002Fmta",". Er akzeptiert das Ereignis ",[15,1306,1307],{},"inbound.mailbox.received",", verlangt, dass der Zeitstempel innerhalb von ",[28,1310,1311],{},"300 Sekunden"," zur aktuellen Zeit liegt, und leitet die geparste Nachricht in die Postbox-Zustellpipeline weiter. Siehe ",[42,1314,1316],{"href":1315},"\u002Fdeveloper\u002Fpostbox-architecture","Postbox-Architektur",[459,1318,1320],{"id":1319},"post-webhooksmta-verify-credential","POST \u002Fwebhooks\u002Fmta-verify-credential",[11,1322,1323,1324,1327,1328,1331,1332,1335,1336,1339,1340,62],{},"Verifizierung von App-Passwörtern für IMAP und die SMTP-Einlieferung. Der MTA-\u002FIMAP-Server postet ",[15,1325,1326],{},"{ address, password, scope: \"imap\" | \"smtp\" }","; dadurch kann er Clients authentifizieren, ohne den Convex-Admin-Key vorzuhalten. Das Zeitstempelfenster ist hier enger — ",[28,1329,1330],{},"60 Sekunden",". Bei einer Übereinstimmung liefert er ",[15,1333,1334],{},"{ ok: true, mailboxId, appPasswordId, userId, organizationId }",", andernfalls ",[15,1337,1338],{},"{ ok: false }",". Siehe ",[42,1341,1316],{"href":1342},"\u002Fdeveloper\u002Fpostbox-architecture#app-password-auth-flow",[20,1344,1346],{"title":1345,"type":23},"Ausgehende Webhooks sind separat",[11,1347,1348,1349,1352,1353,1356,1357,1361,1362,62],{},"Auf dieser Seite geht es um Webhooks, die Owlat ",[33,1350,1351],{},"empfängt",". Für die Webhooks, die Owlat an Ihre Endpunkte ",[33,1354,1355],{},"sendet"," (Zustellereignisse, Kontakt- und Themenänderungen), siehe ",[42,1358,1360],{"href":1359},"\u002Fapi\u002Fwebhooks","Webhooks"," und den Contract der ",[42,1363,1365],{"href":1364},"\u002Fapi\u002Fwebhook-payloads","Webhook-Payloads",[48,1367,1369],{"id":1368},"verwandte-themen","Verwandte Themen",[1371,1372],"link-card",{"description":1373,"title":45,"to":44},"Was E-Mail-, Chat-, SMS-, WhatsApp- und generische Kanäle im Produkt heute leisten.",[1371,1375],{"description":1376,"title":1377,"to":1378},"Die übrigen nicht authentifizierten HTTP-Routen: Tracking, Abmeldung, Formulare, Archiv und Freigabelinks.","Öffentliche Endpunkte","\u002Fapi\u002Fpublic-endpoints",[1380,1381,1382],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sYgZi, html code.shiki .sYgZi{--shiki-default:#24292E;--shiki-dark:#ADBAC7}html pre.shiki code .snmFh, html code.shiki .snmFh{--shiki-default:#005CC5;--shiki-dark:#8DDB8C}html pre.shiki code .s-HuK, html code.shiki .s-HuK{--shiki-default:#032F62;--shiki-dark:#96D0FF}",{"title":387,"searchDepth":400,"depth":400,"links":1384},[1385,1386,1387,1391,1392,1393,1397],{"id":50,"depth":400,"text":51},{"id":190,"depth":400,"text":191},{"id":446,"depth":400,"text":447,"children":1388},[1389,1390],{"id":461,"depth":406,"text":462},{"id":636,"depth":406,"text":637},{"id":728,"depth":400,"text":729},{"id":1023,"depth":400,"text":1024},{"id":1264,"depth":400,"text":1265,"children":1394},[1395,1396],{"id":1296,"depth":406,"text":1297},{"id":1319,"depth":406,"text":1320},{"id":1368,"depth":400,"text":1369},"Provider-Webhook-Referenz für eingehende SMS-, WhatsApp- und Generic-Channel-Nachrichten sowie die MTA-Mailbox- und Credential-Callbacks.","md",{},"\u002Fapi\u002Finbound-channels",{"title":6,"description":1398},"2.api\u002F13.inbound-channels","9GYH74EQI31kp2weDiqD1q_TOi8MSl5_UlGhTX4ZX2Y",[1406,1408],{"title":1365,"path":1364,"stem":1407,"children":-1},"2.api\u002F12.webhook-payloads",{"title":1409,"path":1410,"stem":1411,"children":-1},"Authentifizierung","\u002Fapi\u002Fauthentication","2.api\u002F2.authentication",1786915107037]