POST /webhooks/meta/{product}
Meta event delivery, signed with X-Hub-Signature-256 (sha256=<hex HMAC of the raw body>) by the product's app secret (instagram: INSTAGRAM_CLIENT_SECRET, facebook: FACEBOOK_APP_SECRET, threads: THREADS_APP_SECRET, whatsapp: WHATSAPP_APP_SECRET, then FACEBOOK_APP_SECRET). Stored as inbound events (deduplicated) and emitted as comment.received / mention.received; messaging events are stored as conversations and messages and emitted as message.*
product*string"instagram""facebook""threads""whatsapp"X-Hub-Signature-256*stringapplication/json- body
Instagram {object:"instagram", entry:[{id, time, changes:[{field:"comments"|"live_comments"|"mentions", value}]}]}; Facebook {object:"page", entry:[{id, changes:[{field:"feed", value:{item, verb, comment_id, post_id, message, from, parent_id}}]}]}; Threads fields replies / mentions. Messaging: entry[].messaging[{sender{id}, recipient{id}, timestamp, message|read|delivery|reaction|postback|referral}] (Instagram and Messenger), or a messaging field (messages, messaging_seen, message_reactions, messaging_postbacks, ...) whose value is one such event. WhatsApp {object:"whatsapp_business_account", entry:[{id: WABA id, changes:[{field:"messages"|"message_template_status_update"|"message_template_quality_update"|"template_category_update"|"phone_number_quality_update"|..., value}]}]}
{received, events, duplicates, ignored, unmatched}
application/json- response
received?booleanevents?integerduplicates?integerignored?integerunmatched?integercurl -X POST 'https://example.com/api/webhooks/meta/instagram' \ -H 'X-Hub-Signature-256: string' \ -H 'Content-Type: application/json' \ -d '{}'{ "received": true, "events": 0, "duplicates": 0, "ignored": 0, "unmatched": 0}