# Chatbot Events: Send Chatbot Events to Your Systems

Receive chatbot events on your own webhook, check their signature, and pause or resume sending from the chatbot's Events tab.

> Source: https://www.robylon.ai/docs/developers/chatbot-events
> Section: Developers

Chatbot events let your own systems react to what happens in the chatbot. Robylon sends each event to a webhook URL you set in your chatbot's **Events** tab.

## What does the Events tab send?

The **Events** tab sends chat activity to a webhook on your own server, for example so your app can notify a customer who has left the chat.

Enter a **Webhook URL** (an HTTPS address reachable from the internet) and save it, then use **Send Test Event** to check that your server receives it. Robylon creates the **Secret Key** for you; you can regenerate it, and the old key stops working straight away. A switch in the section header pauses or resumes sending. **Events Documentation** on the tab has the full reference.

### Which events are sent?

There is one event today, `message.sent`. It is sent when a human or AI agent sends a message while the customer is away from the chat screen (no activity for 30 seconds, or the chat is closed). A customer who is watching the chat does not generate an event. Each message sends its own event.

Events are only sent for customers your website or app has identified to the chatbot with a user ID (see [Installation](https://www.robylon.ai/docs/chatbot/installation)). Internal notes, system messages and typing indicators are never sent.

### What does an event look like?

Each event is a JSON `POST` to your URL. Reply with any `2xx` status within 5 seconds. The body includes the customer (`client_user_id`, `session_id`, `chatbot_id`), the message (sender type and name, message type, and a text preview of up to 120 characters), an `event_id` and a `timestamp`. Failed deliveries are retried with the same `event_id`, so ignore duplicates, and events can arrive out of order.

### How do I check an event came from Robylon?

Each request has these headers:

| Header | What it holds |
| --- | --- |
| `X-Robylon-Event` | The event type, for example `message.sent`. |
| `X-Robylon-Timestamp` | The time of sending, in Unix seconds. |
| `X-Robylon-Signature` | `sha256=` followed by an HMAC-SHA256 of the timestamp, a full stop and the raw request body, keyed with your secret key. |
| `X-Robylon-Attempt` | `1` on the first delivery, higher on retries. |

Compute the same HMAC on your server over the raw body (before parsing the JSON) and compare it with the signature. Reject events whose timestamp is more than a few minutes old.