---
title: "Webhooks"
description: "Check that an event is from Goomzo, and manage your endpoints."
url: "https://docs.goomzo.africa/docs/developers/go-sdk/webhooks"
docs_index: /llms.txt
lastUpdated: 2026-11-12
section: "Guides"
related:
  - /docs/developers/go-sdk/messages
  - /docs/developers/go-sdk/templates
  - /docs/developers/go-sdk/customers
---

> For an index of all documentation, see [/llms.txt](https://docs.goomzo.africa/llms.txt). Any page is also available as Markdown by adding .md to its URL.

# Webhooks

> Check that an event is from Goomzo, and manage your endpoints.

`goomzo.VerifyWebhook` checks an event's signature and timestamp, and returns the event. See
[Signatures](https://docs.goomzo.africa/docs/developers/webhooks/signatures?utm_source=llms&utm_medium=ai).

## Requirements

- An endpoint, and its signing secret, which starts with `whsec_`. See [Webhooks](https://docs.goomzo.africa/docs/developers/webhooks?utm_source=llms&utm_medium=ai).

## Receive an event

Pass the body exactly as it arrived, before decoding it:

```go
http.HandleFunc("POST /webhooks/goomzo", func(w http.ResponseWriter, r *http.Request) {
	body, err := io.ReadAll(r.Body)
	if err != nil {
		http.Error(w, "can't read the body", http.StatusBadRequest)
		return
	}
	event, err := goomzo.VerifyWebhook(body, r.Header, os.Getenv("GOOMZO_WEBHOOK_SECRET"))
	if err != nil {
		http.Error(w, "bad signature", http.StatusBadRequest)
		return
	}
	if event.Type == "message.delivered" {
		var msg goomzo.Message
		if err := json.Unmarshal(event.Data, &msg); err == nil {
			markDelivered(msg.ID)
		}
	}
	w.WriteHeader(http.StatusNoContent)
})
```

`event.Data` is the event's data as it came. Decode it into a `goomzo.Message`, a `goomzo.Customer`, or your own
struct, by `event.Type`.

**Important:** Don't decode the body before checking it. The signature is of the body as it arrived.

## Manage endpoints

```go
endpoint, err := client.WebhookEndpoints.Create(ctx, goomzo.WebhookEndpointInput{
	URL:    "https://example.com/webhooks/goomzo",
	Events: []string{"message.delivered", "message.failed"},
})
endpoint.Secret // whsec_…
```

| Method                                      | Does                                  |
| ------------------------------------------- | ------------------------------------- |
| `WebhookEndpoints.List(ctx)`                | Lists your endpoints.                 |
| `WebhookEndpoints.Get(ctx, id)`             | Gets one.                             |
| `WebhookEndpoints.Update(ctx, id, changes)` | Changes an endpoint, or turns it off. |
| `WebhookEndpoints.Delete(ctx, id)`          | Deletes one.                          |

## Next steps

- [Events](https://docs.goomzo.africa/docs/developers/webhooks/events?utm_source=llms&utm_medium=ai)
- [Errors](https://docs.goomzo.africa/docs/developers/go-sdk/errors?utm_source=llms&utm_medium=ai)

---

For an index of all available documentation, see [/llms.txt](https://docs.goomzo.africa/llms.txt)