Home / Docs / Webhooks

Webhooks

Postifys webhook behavior: Meta inbound callbacks, data deletion endpoints, and server-configured outbound publish event webhooks.

Last updated: 2026-08-24 · Technical source: live Postifys API behavior and API reference

Quick answer: Postifys supports Meta inbound webhooks for platform callbacks and can send server-configured outbound publish events to one configured webhook URL. Outbound webhook setup is currently an operator/admin configuration, not a customer self-service API.

What this page covers

  • Meta webhook verification (GET /webhooks/meta)
  • Meta webhook event receiver (POST /webhooks/meta)
  • Meta data-deletion callback (POST /webhooks/meta/data-deletion)
  • Server-configured outbound publish event notifications
Self-service scope: There is not yet a public API where each customer can add, rotate, or list their own webhook URLs. If you need webhook delivery enabled for a workspace, contact Postifys support. Otherwise, poll Post History / status APIs or use n8n branching on the publish node response.

Verify Meta webhook

GET /webhooks/meta returns Meta’s challenge when hub.mode=subscribe and hub.verify_token matches the server META_WEBHOOK_VERIFY_TOKEN.

curl "https://postifys.com/webhooks/meta?hub.mode=subscribe&hub.verify_token=TOKEN&hub.challenge=abc123"

Receive Meta webhook events

POST /webhooks/meta accepts Meta event payloads, logs them server-side, and returns HTTP 200.

curl -X POST https://postifys.com/webhooks/meta \
  -H "Content-Type: application/json" \
  -d '{"object":"page","entry":[]}'

Meta data deletion callback

POST /webhooks/meta/data-deletion verifies Meta’s signed request, deletes stored Facebook/Instagram connection data for the user, and returns a status URL plus confirmation code.

curl -X POST https://postifys.com/webhooks/meta/data-deletion \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data "signed_request=SIGNED_REQUEST_FROM_META"
{
  "url": "https://postifys.com/data-deletion/del_...",
  "confirmation_code": "del_..."
}

Outbound publish events

When outbound webhooks are configured by Postifys operations, publish state changes are delivered to the configured URL as JSON. Delivery currently does not have customer-facing management endpoints or retained delivery history in the public API.

  • post.published when a post is marked published.
  • post.failed when a post fails.
  • post.<status> for internal status transitions emitted by the publishing pipeline.
{
  "event": "post.published",
  "createdAt": "2026-08-24T09:00:00.000Z",
  "post": {
    "id": "post_abc123",
    "userId": "usr_...",
    "platform": "youtube",
    "status": "published",
    "targetId": "YOUTUBE_CHANNEL_ID",
    "type": "VIDEO",
    "retryOf": null,
    "retryCount": 0,
    "failureReason": null,
    "publishedAt": "2026-08-24T09:00:00.000Z",
    "failedAt": null,
    "updatedAt": "2026-08-24T09:00:00.000Z"
  }
}

If an outbound webhook secret is configured, Postifys signs the raw JSON body with X-Postifys-Signature-256: sha256=.... Verify this HMAC SHA-256 signature before trusting the payload.

Security notes

  • Webhook paths are listed under Disallow: /webhooks/ in robots.txt - do not submit them for indexing.
  • Verification tokens and signed requests are server secrets; never expose them in public docs examples beyond placeholders.
  • Data-deletion callbacks are part of Meta compliance flows; see also Security and Privacy.
Next: Rate limits API reference webhooks

Continue learning