> ## Documentation Index
> Fetch the complete documentation index at: https://docs.naturalead.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# WhatsApp Inbound

> Receives inbound WhatsApp messages from the Meta Cloud API. The request
is validated using the `X-Hub-Signature-256` header (HMAC-SHA256 with
`FB_APP_SECRET`). The account is resolved by matching the WABA ID or
phone number ID from the payload against the integration collection.

**Important:** This endpoint always returns HTTP 200 to Meta, even on
errors, to prevent Meta from disabling the webhook.




## OpenAPI

````yaml POST /api/webhooks/meta-whatsapp
openapi: 3.1.0
info:
  title: Naturalead Inbound Webhooks API
  version: 1.0.0
  description: >
    Inbound webhook endpoints for receiving messages and leads from external

    services. These endpoints do not use standard API key authentication.

    Each channel uses its own verification mechanism (token-based,
    signature-based,

    or challenge-response).
servers:
  - url: '{baseUrl}'
    description: API server
    variables:
      baseUrl:
        default: http://localhost:3001
security: []
tags:
  - name: Lead Webhooks
    description: Inbound lead creation via webhook token
  - name: Telegram Webhooks
    description: Inbound Telegram messages
  - name: Email Webhooks
    description: Inbound email messages via Resend
  - name: WhatsApp Webhooks
    description: Inbound WhatsApp messages via Meta Cloud API
paths:
  /api/webhooks/meta-whatsapp:
    post:
      tags:
        - WhatsApp Webhooks
      summary: WhatsApp inbound webhook
      description: |
        Receives inbound WhatsApp messages from the Meta Cloud API. The request
        is validated using the `X-Hub-Signature-256` header (HMAC-SHA256 with
        `FB_APP_SECRET`). The account is resolved by matching the WABA ID or
        phone number ID from the payload against the integration collection.

        **Important:** This endpoint always returns HTTP 200 to Meta, even on
        errors, to prevent Meta from disabling the webhook.
      operationId: whatsappInbound
      parameters:
        - name: X-Hub-Signature-256
          in: header
          required: true
          description: HMAC-SHA256 signature of the request body
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                object:
                  type: string
                  description: Must be "whatsapp_business_account"
                  example: whatsapp_business_account
                entry:
                  type: array
                  items:
                    type: object
                    properties:
                      id:
                        type: string
                        description: WABA ID
                      changes:
                        type: array
                        items:
                          type: object
                          properties:
                            field:
                              type: string
                            value:
                              type: object
                              properties:
                                messages:
                                  type: array
                                  items:
                                    type: object
                                metadata:
                                  type: object
                                  properties:
                                    phone_number_id:
                                      type: string
      responses:
        '200':
          description: Webhook acknowledged (always returns 200)
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: string
                    enum:
                      - ok
                      - ignored
                      - signature_invalid
                      - error
      security: []

````