API referenceWebhooks

sms.received

A text message arrived on one of your numbers (STOP, START and HELP included, flagged). Sent only for conversations the endpoint owner can see, on the endpoint’s connections. Endpoints on API version 2026-10-21 or later.

Header Parameters

Gauge-Signature*string

t=<epoch ms>,v1=<hex>: HMAC-SHA256 of <t>.<raw body> with the endpoint secret. Two v1 during a secret rotation; accept either. Reject a t more than 5 minutes off.

Gauge-Event-Id*string

The event id; the same on every retry and redelivery. Dedupe on it.

Gauge-Event-Type*string

The event type.

Gauge-Delivery-Attempt*string

1 on the first try, then 2, 3, …

Gauge-Webhook-Id*string

The endpoint id.

x-pulse-signature?string

Legacy: sha256=<hex> (the same HMAC). Still sent; prefer Gauge-Signature.

x-pulse-timestamp?string

Legacy: the epoch-ms t.

Request Body

application/json
  1. body

Every delivery body. Bodies over 64 KB are cut: payload.truncated: true with a fetchUrl. Verify the signature on the raw bytes before parsing.

id*string

The event id. Identical on every retry and redelivery: dedupe on it.

event*"sms.received"
Value in"sms.received"
livemode*boolean

False for events about sandbox data.

workspaceId*string
Formatuuid
entity*string
entityId*string
occurredAt*string
Formatdate-time
payload*

Response Body

Received. Any other status is retried (30 s, 5 min, 1 h, 6 h).

Example Requests
POST/sms.received
Request Body
application/json
{  "id": "string",  "event": "string",  "livemode": true,  "workspaceId": "ef0efa32-d1c1-43d4-a5e2-fe7b4f00403c",  "entity": "string",  "entityId": "string",  "occurredAt": "2019-08-24T14:15:22Z",  "payload": {    "property1": null,    "property2": null  }}
Header Parameters
{  "Gauge-Signature": "string",  "Gauge-Event-Id": "string",  "Gauge-Event-Type": "string",  "Gauge-Delivery-Attempt": "string",  "Gauge-Webhook-Id": "string"}