Chatbot events
Receive chatbot events on your own webhook, check their signature, and pause or resume sending from the chatbot's Events tab.
Chatbot events let your own systems react to what happens in the chatbot. Robylon sends each event to a webhook URL you set in your chatbot’s Events tab.
What does the Events tab send?
The Events tab sends chat activity to a webhook on your own server, for example so your app can notify a customer who has left the chat.
Enter a Webhook URL (an HTTPS address reachable from the internet) and save it, then use Send Test Event to check that your server receives it. Robylon creates the Secret Key for you; you can regenerate it, and the old key stops working straight away. A switch in the section header pauses or resumes sending. Events Documentation on the tab has the full reference.
Which events are sent?
There is one event today, message.sent. It is sent when a human or AI agent sends a message while the customer is away from the chat screen (no activity for 30 seconds, or the chat is closed). A customer who is watching the chat does not generate an event. Each message sends its own event.
Events are only sent for customers your website or app has identified to the chatbot with a user ID (see Installation). Internal notes, system messages and typing indicators are never sent.
What does an event look like?
Each event is a JSON POST to your URL. Reply with any 2xx status within 5 seconds. The body includes the customer (client_user_id, session_id, chatbot_id), the message (sender type and name, message type, and a text preview of up to 120 characters), an event_id and a timestamp. Failed deliveries are retried with the same event_id, so ignore duplicates, and events can arrive out of order.
How do I check an event came from Robylon?
Each request has these headers:
| Header | What it holds |
|---|---|
X-Robylon-Event |
The event type, for example message.sent. |
X-Robylon-Timestamp |
The time of sending, in Unix seconds. |
X-Robylon-Signature |
sha256= followed by an HMAC-SHA256 of the timestamp, a full stop and the raw request body, keyed with your secret key. |
X-Robylon-Attempt |
1 on the first delivery, higher on retries. |
Compute the same HMAC on your server over the raw body (before parsing the JSON) and compare it with the signature. Reject events whose timestamp is more than a few minutes old.