Skip to main content

​
Description

When the agent produces a bubble, Jelou POSTs to your webhookUrl with the formatted message. Delivery has a 20-second budget covering up to 3 attempts — see Delivery and retries.

​
Envelope

​
Delivery headers

  • Content-Type: application/json
  • Auth from credentials.auth (when configured):
    • api_key → configurable header (default X-Api-Key)
    • bearer → Authorization: Bearer <value>
    • basic → value is the full username:password string before Base64; the header is Authorization: Basic <base64(username:password)>
  • X-Jelou-Signature: sha256=<hmac> computed over the exact raw HTTP body bytes (always present; the signing key is required). Verify against that raw body before parsing it as JSON; do not re-serialize the parsed object.

​
Message types (message)

Flow text with interactive options usually arrives as type: "BUTTONS", not TEXT. The wire type for quick replies is QUICK_REPLY (underscore). The Sticker block is not available in the builder for this channel.

​
Examples

​
Delivery and retries

Your endpoint must return 2xx. Jelou retries a failed delivery up to 3 attempts in total, all of them inside a single 20-second budget — the budget covers every attempt plus the waits between them, so delivery of one message never takes longer than 20 seconds. Backoff between attempts is exponential with jitter (roughly 300 ms, then 600 ms).
You must deduplicate. Every attempt for the same message carries an identical body, an identical message.messageId and an identical X-Jelou-Signature. Treat message.messageId as an idempotency key: if you have already processed it, return 2xx and do nothing else. Returning 5xx after you have already processed a message will make Jelou deliver it again.
Each delivery carries an X-Jelou-Delivery-Attempt header (1, 2, 3) telling you which attempt you are looking at — useful for logging.
That header is not authenticated: the HMAC covers the request body, so anyone replaying a captured request can set any value they like. Never use it as replay protection. Verify X-Jelou-Signature first, then deduplicate by the authenticated message.messageId.
If all attempts fail the message is not delivered and the turn is aborted; there is no queued redelivery in this version.