Dónde está y quién puede usarlo. Ajustes → Webhooks. Solo Owner y Manager pueden gestionarlos, y la función está incluida en el plan Business. Si el plan no lo incluye, la pestaña aparece con candado y no se envía nada.

const crypto = require('crypto');
const express = require('express');
const app = express();

// Importante: leer el cuerpo SIN parsear para calcular la firma
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', process.env.PARLO_WEBHOOK_SECRET)
    .update(req.body).digest('hex');
  const got = req.get('X-Chat-Signature') || '';
  const ok = got.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(got), Buffer.from(expected));
  if (!ok) return res.sendStatus(401);

  res.sendStatus(200);                        // responde enseguida
  const { type, data } = JSON.parse(req.body.toString('utf8'));
  for (const ev of data) console.log(type, ev);
});
app.listen(3000);

<?php
$raw = file_get_contents('php://input');
$expected = 'sha256=' . hash_hmac('sha256', $raw, getenv('PARLO_WEBHOOK_SECRET'));
$got = $_SERVER['HTTP_X_CHAT_SIGNATURE'] ?? '';
if (!hash_equals($expected, $got)) { http_response_code(401); exit; }

$payload = json_decode($raw, true);
foreach ($payload['data'] as $ev) {
    // $payload['type'] es chat_message, user_joined, user_left o chat_action
    error_log($payload['type'] . ' ' . json_encode($ev));
}
http_response_code(200);

import hmac, hashlib, os
from flask import Flask, request, abort

app = Flask(__name__)

@app.post('/webhook')
def webhook():
    raw = request.get_data()   # cuerpo sin modificar
    expected = 'sha256=' + hmac.new(
        os.environ['PARLO_WEBHOOK_SECRET'].encode(), raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, request.headers.get('X-Chat-Signature', '')):
        abort(401)
    payload = request.get_json(force=True)
    for ev in payload['data']:
        print(payload['type'], ev)
    return '', 200

{
  "type": "chat_message",
  "data": [
    {
      "msg_id": "1042", "chat_id": "mi-chat", "chat_name": "Mi chat", "channel": "main",
      "user_id": "7", "username": "ana", "nickname": "Ana", "profile_picture_url": null,
      "message": "Hola a todos", "rank": "member", "edited": false,
      "attachment": null, "attachment_id": null, "attachment_type": null,
      "reply_to_id": null, "ip": "203.0.113.5", "timestamp": 1760000000
    }
  ]
}

{
  "type": "chat_action",
  "data": [
    {
      "action_type": "mute", "chat_id": "mi-chat", "chat_name": "Mi chat", "channel": "main",
      "user_id": "2", "username": "mod1", "nickname": "Mod 1", "profile_picture_url": null, "rank": "moderator",
      "a_user_id": "7", "a_username": "ana", "a_nickname": "Ana", "a_profile_picture_url": null, "a_rank": "member",
      "reason": "spam", "expires_at": 1760003600000, "duration_minutes": 60,
      "timestamp": 1760000000
    }
  ]
}

Ojo con la privacidad: los mensajes y las acciones incluyen la IP de los usuarios. Si guardas esos datos, trátalos según tu política de privacidad y la normativa que te aplique (por ejemplo RGPD).

Where it is and who can use it. Settings → Webhooks. Only Owners and Managers can manage them, and the feature is included in the Business plan. If your plan doesn’t include it, the tab shows a lock and nothing is sent.

const crypto = require('crypto');
const express = require('express');
const app = express();

// Important: read the body UNPARSED to compute the signature
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', process.env.PARLO_WEBHOOK_SECRET)
    .update(req.body).digest('hex');
  const got = req.get('X-Chat-Signature') || '';
  const ok = got.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(got), Buffer.from(expected));
  if (!ok) return res.sendStatus(401);

  res.sendStatus(200);                        // reply right away
  const { type, data } = JSON.parse(req.body.toString('utf8'));
  for (const ev of data) console.log(type, ev);
});
app.listen(3000);

<?php
$raw = file_get_contents('php://input');
$expected = 'sha256=' . hash_hmac('sha256', $raw, getenv('PARLO_WEBHOOK_SECRET'));
$got = $_SERVER['HTTP_X_CHAT_SIGNATURE'] ?? '';
if (!hash_equals($expected, $got)) { http_response_code(401); exit; }

$payload = json_decode($raw, true);
foreach ($payload['data'] as $ev) {
    // $payload['type'] is chat_message, user_joined, user_left or chat_action
    error_log($payload['type'] . ' ' . json_encode($ev));
}
http_response_code(200);

import hmac, hashlib, os
from flask import Flask, request, abort

app = Flask(__name__)

@app.post('/webhook')
def webhook():
    raw = request.get_data()   # unmodified body
    expected = 'sha256=' + hmac.new(
        os.environ['PARLO_WEBHOOK_SECRET'].encode(), raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, request.headers.get('X-Chat-Signature', '')):
        abort(401)
    payload = request.get_json(force=True)
    for ev in payload['data']:
        print(payload['type'], ev)
    return '', 200

{
  "type": "chat_message",
  "data": [
    {
      "msg_id": "1042", "chat_id": "my-chat", "chat_name": "My chat", "channel": "main",
      "user_id": "7", "username": "ana", "nickname": "Ana", "profile_picture_url": null,
      "message": "Hello everyone", "rank": "member", "edited": false,
      "attachment": null, "attachment_id": null, "attachment_type": null,
      "reply_to_id": null, "ip": "203.0.113.5", "timestamp": 1760000000
    }
  ]
}

{
  "type": "chat_action",
  "data": [
    {
      "action_type": "mute", "chat_id": "my-chat", "chat_name": "My chat", "channel": "main",
      "user_id": "2", "username": "mod1", "nickname": "Mod 1", "profile_picture_url": null, "rank": "moderator",
      "a_user_id": "7", "a_username": "ana", "a_nickname": "Ana", "a_profile_picture_url": null, "a_rank": "member",
      "reason": "spam", "expires_at": 1760003600000, "duration_minutes": 60,
      "timestamp": 1760000000
    }
  ]
}

Mind privacy: messages and actions include users’ IP addresses. If you store that data, handle it according to your privacy policy and the regulations that apply to you (for example GDPR).