Webhook subscriptions in CPaaS X

Webhooks are created through subscriptions, an Infobip platform feature for real-time event notifications. In CPaaS X, subscriptions support scoped event delivery through criteria filtering: you can subscribe to events for a specific applicationId, entityId, or both. This keeps each entity informed about its own events without mixing data from other entities.

The multi-tenant event delivery challenge [#multi-tenant-event-delivery-challenge]

In traditional multi-tenant platforms without scoped subscriptions, all events flow to a single webhook without filtering. Your code must attribute each event to the correct customer, adding complexity and creating security risks if events are misrouted.

Without scoped subscriptions

A single webhook receives all events from all customers. Your system must manually parse, filter, and route events by customer. This is complex, error-prone, and creates security risks with cross-customer data leakage.

With scoped subscriptions

Each customer gets their own webhook that receives only their events. CPaaS X filters at the platform level using criteria. No manual parsing, routing, or filtering needed in your code.

How scoped subscriptions work [#how-scoped-subscriptions-work]

When creating a subscription in CPaaS X, you define filters to scope events by applicationId, entityId, user, or resource. A subscription triggers only when all filter conditions match the event. You can manage subscriptions through the web interface (Developer tools > Subscriptions Management) or the Subscriptions API.

The customer-a webhook automatically receives only customer-a events, eliminating manual filtering logic from your code.

Why scoped event delivery matters [#why-scoped-event-delivery-matters]

Scoped subscriptions provide three critical advantages for multi-tenant platforms:

Data isolation

Enforced at the platform level. Customer A's webhook never receives Customer B's events. Audit trails are naturally segregated per entity for compliance.

Simplified integration

Each webhook receives only events for its assigned entity. No need to receive all events and parse them to determine which customer they belong to.

Direct customer integration

Give each customer their own entity-scoped webhook endpoint. They receive real-time updates about their own events and can build integrations independently.

Subscription types [#subscription-types]

Application-level subscriptions

Receives all events from all entities within an application. Scoped by applicationId only (no entityId).

Best for: Platform monitoring, usage tracking, and compliance audits by your admin and operations teams.

Entity-level subscriptions

Receives only events for a specific entity. Scoped by both applicationId and entityId.

Best for: Customer-facing updates and per-customer event handling. Each customer or backend system serving a specific entity gets its own webhook.

Supported channels and event types [#supported-channels-and-events]

Subscriptions support more than 20 channels, products, and services including SMS, MMS, Email, WhatsApp, RCS, Viber, and Voice. For the complete list of events by channel, see Available webhook events.

Event content with entity/application context [#event-content]

When CPaaS X sends webhook events, they include the entity and application context. Both applicationId and entityId appear in delivery reports and callback events, allowing you to track traffic and events by application and entity.

Learn more

• Implementation and event types: See Webhook subscriptions.
• Application and entity context: See Applications and entities.