Webhook ingestion - Assistable.ai Docs

Direct sub-accounts receive messages through one authenticated endpoint. Post a message to it and Assistable resolves (or creates) the native contact and conversation, stores the message, and runs the bound assistant to reply.

POST https://api.assistable.ai/listener-assistable-direct

This endpoint lives at the platform root (not under /v3) and is authenticated by the sub-account’s webhook secret, not your API key — so an external CRM or your own backend can call it directly.

Authentication

Send the webhookSecret from the create-sub-account response as either header:

# either
-H "x-assistable-webhook-secret: whsec_…"
# or
-H "Authorization: Bearer whsec_…"

A bad or missing secret returns 401. The secret is compared in constant time.

Request body

{
  "subAccountId": "sub_123",
  "body": "Hi, is anyone there?",
  "channel": "SMS",
  "direction": "inbound",
  "externalMessageId": "msg_abc",
  "contact": {
    "phone": "+15551234567",
    "firstName": "Jane",
    "email": "[email protected]"
  }
}

Field	Required	Notes
`subAccountId`	yes	The Direct sub-account receiving the message.
`body`	yes	Message text. Empty bodies are rejected.
`contact`	yes	One of `id`, `phone`, or `email` to resolve/create the contact (`firstName`, `lastName`, `name` optional).
`channel`	no	e.g. `SMS`, `Chat`, `Email`. Defaults to `Chat`.
`direction`	no	`inbound` (default) or `outbound`.
`externalMessageId`	no	Your id for the message; used to de-duplicate retries.
`conversationId`	no	Target an existing native conversation; otherwise resolved per contact + channel.

What happens next

Ingest

The contact is resolved (by id → phone → email) or created, the conversation is found-or-created, and the message is stored natively.

Enrich

Human-takeover and sleep gates are checked, and the conversation is bound to the sub-account’s active assistant.

The assistant runs and the reply is written back as a native message (and emitted on the message.sent webhook). No GoHighLevel is involved.

Re-posting the same externalMessageId for a sub-account within a short window is de-duplicated, so safe retries won’t create duplicate messages.

​Authentication

​Request body

​What happens next

Authentication

Request body

What happens next