Inbound webhooks

Post a message into a channel from your own systems. Translation follows the sender’s current AI permission and the integration’s explicit authorization; otherwise the message is delivered as original text.

POST /webhooks/{webhook}/messages

Body

Field	Required	Description
content	✅	The message text.
channel_id	–	Target channel; defaults to the webhook’s configured channel.
skip_translation	–	Post the content as-is, without translating.
ai_processing_authorized	–	Defaults to false. Set true only when you have authority to send this content to the disclosed AI providers. The sending account must also have current AI permission.

The message appears with the webhook’s configured bot identity — its bot_name and bot_avatar_url — so posts show up as your integration, not a person.

AI permission

The sending account must first review the AI disclosure and allow processing in Profile → AI processing and privacy. Enabling a Workspace or possessing a webhook secret does not grant permission for another person’s content.

The same ai_processing_authorized field is required to opt in on POST /api/v1/automation/workspaces/{workspace}/channels/{channel}/messages. Without both permissions, new messages stay in original text and do not enqueue translation. Existing messages without a consent snapshot are not retroactively translated when permission is granted later.

Authentication

A webhook uses one of two schemes:

• Static secret (default) — send the secret in the X-Rosetta-Webhook-Secret header (or a secret body field).

• HMAC signature (opt-in, signature_required) — sign like the outbound direction and send:

  X-Rosetta-Signature: t=<unix>,v1=<hmac_sha256("<t>.<body>", signing_secret)>

  The timestamp must be within a 5-minute freshness window (replay guard).

Idempotency

Send an Idempotency-Key header to make retries safe. A repeated key within the retention window replays the original result instead of posting a duplicate — so network retries never double-post.

curl -X POST https://api.rosettachat.app/webhooks/wbk_.../messages \
  -H "X-Rosetta-Webhook-Secret: <secret>" \
  -H "Idempotency-Key: 8f14e45f" \
  -H "Content-Type: application/json" \
  -d '{"content":"Deploy finished ✅"}'

Inbound requests count against your workspace’s webhook-request quota. Every request — accepted or rejected — is recorded in the inbound request log for self-debugging.