> ## Documentation Index > Fetch the complete documentation index at: https://docs.xerobi.com/llms.txt > Use this file to discover all available pages before exploring further. # Register Webhook > Register a new webhook endpoint to receive delivery status updates. **Security:** - Webhooks are signed with HMAC-SHA256 - Verify signature using `X-Xerobi-Signature` header - Secret is provided in the response **Retry Logic:** - Failed deliveries are retried with exponential backoff - Maximum 3 retry attempts - Webhook disabled after 10 consecutive failures **Payload Example:** ```json { "event": "message.delivered", "message_id": "msg_abc123", "to": "8801712345678", "status": "delivered", "delivered_at": "2026-01-15T10:30:15Z" } ``` ## OpenAPI ````yaml sms-api/openapi.json POST /webhooks openapi: 3.1.0 info: title: Xerobi SMS Gateway API version: '2026-01-01' description: >- A modern, developer-friendly SMS Gateway API supporting transactional, OTP, promotional and bulk messaging. ## Overview The Xerobi SMS Gateway API enables you to send SMS messages programmatically with support for: - **Transactional SMS**: Account notifications, confirmations, alerts - **OTP Messages**: One-time passwords with optimized delivery routes - **Promotional SMS**: Marketing campaigns and announcements - **Bulk Messaging**: Send to thousands of recipients efficiently - **Templates**: Reusable message templates with variable substitution - **Webhooks**: Real-time delivery status notifications ## Authentication Authenticate using your API key as a Bearer token: ```bash curl -H "Authorization: Bearer sk_live_xxxxx" \ -H "Xerobi-Version: 2026-01-01" \ https://api.hixbe.com/sms/messages ``` **API Key Types:** - `sk_live_*` - Production keys for live messaging - `sk_test_*` - Test keys for development (no actual SMS sent) Get your API keys from the [Xerobi Dashboard](https://dashboard.hixbe.com/api-keys). ## Rate Limits - **Standard accounts**: 100 requests/minute - **Business accounts**: 1,000 requests/minute - **Enterprise accounts**: Custom limits Rate limit headers are included in all responses: - `X-RateLimit-Limit`: Maximum requests per window - `X-RateLimit-Remaining`: Requests remaining - `X-RateLimit-Reset`: Unix timestamp when limit resets ## Message Routes Different routes optimize for delivery speed, reliability, and cost: | Route | Use Case | Delivery Speed | Cost | |-------|----------|----------------|------| | **otp** | One-time passwords | < 5 seconds | Premium | | **transactional** | Notifications, alerts | < 30 seconds | Standard | | **promotional** | Marketing messages | < 2 minutes | Economy | ## Phone Number Format Phone numbers must be in international format without + or spaces: - ✅ Correct: `8801712345678` (Bangladesh) - ✅ Correct: `14155551234` (USA) - ❌ Incorrect: `+880 171 234 5678` - ❌ Incorrect: `01712345678` ## Idempotency Include `Idempotency-Key` header to safely retry requests: ```bash curl -H "Idempotency-Key: unique-key-123" \ -H "Authorization: Bearer sk_live_xxxxx" \ ... ``` ## Webhooks Receive real-time delivery updates via webhooks. Events include: - `message.queued` - Message accepted and queued - `message.sent` - Message sent to carrier - `message.delivered` - Successfully delivered - `message.failed` - Delivery failed ## Support Need help? Contact us: - Email: support@xerobi.com - Documentation: https://developer.hixbe.com - Status: https://status.hixbe.com contact: name: Xerobi Developer Support url: https://developer.hixbe.com email: support@xerobi.com termsOfService: https://hixbe.com/terms license: name: Commercial url: https://hixbe.com/license servers: - url: https://api.hixbe.com/sms description: Production Server - url: https://api-sandbox.hixbe.com/sms description: Sandbox Server (test mode) security: - bearerAuth: [] tags: - name: Messages description: Send and track individual SMS messages - name: Bulk description: CSV and list-based bulk sending for campaigns - name: Senders description: Manage sender IDs and registration - name: Templates description: Create and manage message templates with variables - name: Reports description: Delivery statistics and usage analytics - name: Account description: Balance, usage limits and account profile - name: Webhooks description: Configure delivery report callbacks paths: /webhooks: post: tags: - Webhooks summary: Register webhook description: |- Register a new webhook endpoint to receive delivery status updates. **Security:** - Webhooks are signed with HMAC-SHA256 - Verify signature using `X-Xerobi-Signature` header - Secret is provided in the response **Retry Logic:** - Failed deliveries are retried with exponential backoff - Maximum 3 retry attempts - Webhook disabled after 10 consecutive failures **Payload Example:** ```json { "event": "message.delivered", "message_id": "msg_abc123", "to": "8801712345678", "status": "delivered", "delivered_at": "2026-01-15T10:30:15Z" } ``` operationId: registerWebhook parameters: - $ref: '#/components/parameters/Xerobi-Version' requestBody: required: true content: application/json: schema: type: object properties: url: type: string format: uri description: Webhook callback URL (must be HTTPS) example: https://yourapp.com/webhooks/sms events: type: array description: Events to subscribe to items: type: string enum: - message.queued - message.sent - message.delivered - message.failed - message.expired example: - message.delivered - message.failed minItems: 1 description: type: string description: Optional description for webhook example: Production delivery notifications maxLength: 200 required: - url - events example: url: https://yourapp.com/webhooks/sms events: - message.delivered - message.failed description: Production SMS delivery notifications responses: '201': description: Webhook registered successfully content: application/json: schema: $ref: '#/components/schemas/Webhook' example: id: wh_001xyz url: https://yourapp.com/webhooks/sms events: - message.delivered - message.failed enabled: true secret: whsec_abc123xyz456 retry_config: max_attempts: 3 backoff_seconds: 60 last_triggered_at: null failure_count: 0 created_at: '2026-01-15T10:30:00Z' '400': $ref: '#/components/responses/ValidationError' '401': $ref: '#/components/responses/Unauthorized' components: parameters: Xerobi-Version: name: Xerobi-Version in: header description: >- API version in YYYY-MM-DD format. Using the latest version ensures access to newest features. required: true schema: type: string default: '2026-01-01' pattern: ^\d{4}-\d{2}-\d{2}$ example: '2026-01-01' schemas: Webhook: type: object description: Webhook configuration for delivery status callbacks properties: id: type: string description: Unique webhook identifier example: wh_001xyz url: type: string format: uri description: Callback URL (must be HTTPS) example: https://yourapp.com/webhooks/sms events: type: array description: List of events to receive items: type: string enum: - message.queued - message.sent - message.delivered - message.failed - message.expired example: - message.delivered - message.failed enabled: type: boolean description: Whether webhook is currently active example: true secret: type: string description: Secret key for webhook signature verification example: whsec_abc123xyz456 retry_config: type: object description: Retry configuration for failed deliveries properties: max_attempts: type: integer description: Maximum retry attempts example: 3 minimum: 0 maximum: 10 backoff_seconds: type: integer description: Seconds between retry attempts example: 60 last_triggered_at: type: string format: date-time nullable: true description: Last successful webhook delivery example: '2026-01-15T10:30:00Z' failure_count: type: integer description: Consecutive failure count example: 0 minimum: 0 created_at: type: string format: date-time description: Creation timestamp example: '2025-11-01T12:00:00Z' required: - id - url - events - enabled Error: type: object description: Standard error response with detailed information properties: error: type: object properties: type: type: string description: Error category for programmatic handling example: validation_error code: type: string description: Specific error code example: invalid_phone_number message: type: string description: Human-readable error message example: >- Phone number must be in international format without spaces or special characters param: type: string nullable: true description: Parameter that caused the error example: to request_id: type: string description: Unique request identifier for support and debugging example: req_abc123xyz doc_url: type: string description: Link to relevant documentation example: https://developer.hixbe.com/errors/invalid-phone-number required: - type - code - message - request_id required: - error responses: ValidationError: description: Request validation failed content: application/json: schema: $ref: '#/components/schemas/Error' example: error: type: validation_error code: invalid_phone_number message: >- Phone number must be in international format (e.g., 8801712345678) param: to request_id: req_def456 doc_url: https://developer.hixbe.com/phone-format Unauthorized: description: Authentication failed - invalid or missing API key content: application/json: schema: $ref: '#/components/schemas/Error' example: error: type: authentication_error code: invalid_api_key message: >- Invalid API key provided. Check your API key at https://dashboard.hixbe.com/api-keys request_id: req_abc123 securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: APIKEY description: >- Use your API key as a Bearer token. Format: `Authorization: Bearer sk_live_xxxxx` ```` ## Related topics - [Webhooks](https://docs.xerobi.com/faq-guides/webhooks.md) - [Certification API FAQ](https://docs.xerobi.com/faq-guides/certification-api-faq.md) - [Create Webhook Endpoint](https://docs.xerobi.com/payment-api/endpoint/create-webhook-endpoint.md) - [Create Webhook](https://docs.xerobi.com/certify/endpoint/create-webhook.md) - [SMS API FAQ](https://docs.xerobi.com/faq-guides/sms-api-faq.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.