{
"data": {
"object": "event",
"id": "0193b2f0-7c1e-7a4b-9f3d-2e6c8a1b5d40",
"type": "guestcomm.message.created",
"apiVersion": "2026-11-01",
"occurredAt": "2026-10-30T09:14:02.000Z",
"propertyId": "4a2f0c10-2e7a-4b9d-9b3a-1f0c9e8d7a6b",
"resource": {
"object": "guestcomm.message",
"id": "9c8b1e4f-3a2d-4c5b-8e7f-1a2b3c4d5e6f",
"threadId": "5d4c3b2a-1f0e-4d9c-8b7a-6f5e4d3c2b1a",
"guestId": "7e6d5c4b-3a29-4180-9f8e-7d6c5b4a3928",
"direction": "incoming",
"channel": "sms",
"providerMessageId": "SM8f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c"
}
},
"meta": {
"deliveryId": "0193b2f0-7c20-7d11-8e2a-3f4b5c6d7e8f",
"attempt": 1,
"timestamp": "2026-10-30T09:14:03.120Z"
}
}Guest message created
A new message on a guest conversation, inbound (from the guest) or outbound (to the guest), on any channel.
The payload carries IDs and metadata only: never the message body, attachments, or the guest’s name, phone or email. Fetch those through the API.
{
"data": {
"object": "event",
"id": "0193b2f0-7c1e-7a4b-9f3d-2e6c8a1b5d40",
"type": "guestcomm.message.created",
"apiVersion": "2026-11-01",
"occurredAt": "2026-10-30T09:14:02.000Z",
"propertyId": "4a2f0c10-2e7a-4b9d-9b3a-1f0c9e8d7a6b",
"resource": {
"object": "guestcomm.message",
"id": "9c8b1e4f-3a2d-4c5b-8e7f-1a2b3c4d5e6f",
"threadId": "5d4c3b2a-1f0e-4d9c-8b7a-6f5e4d3c2b1a",
"guestId": "7e6d5c4b-3a29-4180-9f8e-7d6c5b4a3928",
"direction": "incoming",
"channel": "sms",
"providerMessageId": "SM8f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c"
}
},
"meta": {
"deliveryId": "0193b2f0-7c20-7d11-8e2a-3f4b5c6d7e8f",
"attempt": 1,
"timestamp": "2026-10-30T09:14:03.120Z"
}
}Authorizations
API key sent as a bearer token: Authorization: Bearer kyc_live_.... Keys are prefixed kyc_live_ (production) or kyc_test_ (test mode). OAuth2 access tokens (also Bearer) may be supported later — the header never changes.
Headers
The event ID, the same as data.id. Stable across retries: use it to deduplicate. Part of the signed content.
Unix time in seconds when this attempt was sent. New on every attempt. Part of the signed content. Reject a request whose timestamp is more than 5 minutes from your clock.
^[0-9]{1,12}$One or more space-separated signatures, each v1, followed by the base64 HMAC-SHA256 of {webhook-id}.{webhook-timestamp}.{raw body}, keyed with your signing secret (the bytes after decoding the base64 part of whsec_…). Two are sent while a rotated-out secret is in its 24-hour grace period. Accept the request if any one matches.
^v1,[A-Za-z0-9+/]+={0,2}( v1,[A-Za-z0-9+/]+={0,2})*$This delivery of the event to your endpoint, the same as meta.deliveryId. Quote it to KYC support when asking about a delivery. Not part of the signed content.
Identifies KYC webhook requests.
"KYCH-Webhooks/1.0"Body
The body of every webhook request: the event in data, this delivery attempt in meta. Mirrors the API's { data, meta } success envelope. Ignore fields you don't recognise.
What happened. Identical, byte for byte, on every retry of the event.
Hide child attributes
Hide child attributes
Resource type discriminator.
"event"Event ID, also sent as the webhook-id header. Your deduplication key.
"0193b2f0-7c1e-7a4b-9f3d-2e6c8a1b5d40"
Event type, module.object.action. Each type is documented as its own webhook. Ignore types you don't handle; new ones are added without notice.
"guestcomm.message.created""guestcomm.message.created"
Payload schema version: the date it was introduced. Payloads change only additively within a version (Decision 32 records this exception to Decision 3).
"2026-11-01"
When the event happened (UTC). Use it, not delivery order, to sequence events.
"2026-10-30T09:14:02.000Z"
The property the event belongs to, as used in the Kyc-Property-Id header.
"4a2f0c10-2e7a-4b9d-9b3a-1f0c9e8d7a6b"
A message on a guest conversation, as a thin reference: IDs and metadata only. Never the body, attachments, or the guest's name, phone or email.
Hide child attributes
Hide child attributes
Resource type discriminator. Dotted to mirror the event naming (Decision 32).
"guestcomm.message"Message UUID.
The conversation the message belongs to.
The guest on the conversation. null when the conversation isn't linked to a guest record.
incoming: from the guest to the hotel. outgoing: from the hotel (staff or automation) to the guest.
incoming, outgoing How the message was sent, e.g. sms, whatsapp, email, web-app, line, wechat, messenger. New values are added without notice; treat unknown ones as "other".
"sms"
The messaging provider's ID for the message, when known. Often null for outgoing messages, whose provider ID arrives after the event.
"SM8f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c"
This delivery attempt. Changes on every retry and is not part of the event.
Hide child attributes
Hide child attributes
This event's delivery to your endpoint, also sent as the Kyc-Delivery-Id header.
"0193b2f0-7c20-7d11-8e2a-3f4b5c6d7e8f"
Attempt number, starting at 1.
x >= 11
When this attempt was sent (UTC), with milliseconds. The same moment as the webhook-timestamp header.
"2026-10-30T09:14:03.120Z"
Response
Stop sending. KYC disables the endpoint at once and sends nothing more until it is re-enabled. Use this only when the endpoint is retired for good.