---
title: "Webhooks"
description: "Check that an event is from Goomzo, and manage your endpoints."
url: "https://docs.goomzo.africa/docs/developers/php-sdk/webhooks"
docs_index: /llms.txt
lastUpdated: 2026-11-12
section: "Guides"
related:
  - /docs/developers/php-sdk/messages
  - /docs/developers/php-sdk/templates
  - /docs/developers/php-sdk/customers
---

> For an index of all documentation, see [/llms.txt](https://docs.goomzo.africa/llms.txt). Any page is also available as Markdown by adding .md to its URL.

# Webhooks

> Check that an event is from Goomzo, and manage your endpoints.

`Webhook::verify` checks an event's signature and timestamp, and returns the event. See
[Signatures](https://docs.goomzo.africa/docs/developers/webhooks/signatures?utm_source=llms&utm_medium=ai).

## Requirements

- An endpoint, and its signing secret, which starts with `whsec_`. See [Webhooks](https://docs.goomzo.africa/docs/developers/webhooks?utm_source=llms&utm_medium=ai).

## Receive an event

Pass the body exactly as it arrived, before decoding it:

```php title="Plain PHP"
use Goomzo\Exception\WebhookVerificationException;
use Goomzo\Webhook;

try {
    $event = Webhook::verify(file_get_contents('php://input'), getallheaders(), getenv('GOOMZO_WEBHOOK_SECRET'));
} catch (WebhookVerificationException) {
    http_response_code(400);
    exit;
}
if ($event['type'] === 'message.delivered') {
    markDelivered($event['data']['id']);
}
http_response_code(204);
```

```php title="Laravel"
use Goomzo\Exception\WebhookVerificationException;
use Goomzo\Webhook;
use Illuminate\Http\Request;

Route::post('/webhooks/goomzo', function (Request $request) {
    try {
        $event = Webhook::verify($request->getContent(), $request->headers->all(), config('services.goomzo.webhook_secret'));
    } catch (WebhookVerificationException) {
        abort(400);
    }
    // …
    return response()->noContent();
});
```

**Important:** Don't decode the body before checking it. The signature is of the body as it arrived. In Laravel,
leave the route out of CSRF protection.

## Manage endpoints

```php
$endpoint = $goomzo->webhookEndpoints->create([
    'url' => 'https://example.com/webhooks/goomzo',
    'events' => ['message.delivered', 'message.failed'],
]);
$endpoint['secret']; // whsec_…
```

| Method                                    | Does                                  |
| ----------------------------------------- | ------------------------------------- |
| `webhookEndpoints->list()`                | Lists your endpoints.                 |
| `webhookEndpoints->get($id)`              | Gets one.                             |
| `webhookEndpoints->update($id, $changes)` | Changes an endpoint, or turns it off. |
| `webhookEndpoints->delete($id)`           | Deletes one.                          |

## Next steps

- [Events](https://docs.goomzo.africa/docs/developers/webhooks/events?utm_source=llms&utm_medium=ai)
- [Errors](https://docs.goomzo.africa/docs/developers/php-sdk/errors?utm_source=llms&utm_medium=ai)

---

For an index of all available documentation, see [/llms.txt](https://docs.goomzo.africa/llms.txt)