Bot API · Bot token
setWebhook
Set the webhook URL for incoming updates
Registers an HTTPS webhook URL for this bot+env (upsert on bot_id,env). Deliveries POST the update JSON with headers X-Sprintelex-Bot-Secret: <secret_token> (empty string when none set) and X-Sprintelex-Signature: sha256=<hex HMAC-SHA256(body, secret_token)> (absent when no secret is set). an empty url string DELETES the webhook instead of setting one. Setting a URL clears is_disabled and any previous error state.
Request
curl https://api.sprintelex.com/setWebhook \
-H "Authorization: Bearer <bot-token>" \
-H "Content-Type: application/json" \
-d '{"url":"https://example.com/sprintex-webhook"}'Parameters
| Name | Type | Required | Rules |
|---|---|---|---|
| url | string | Yes | empty string deletes the webhook; otherwise must pass SSRF gate: valid URL, https-only, no userinfo/credentials, no literal private/loopback/link-local/multicast IP host, no localhost/.localhost/.local/.internal/.invalid hostname, and the hostname must not DNS-resolve to a private IP |
| secret_token | string | No | optional; at most 256 characters; echoed back on deliveries as X-Sprintelex-Bot-Secret and used for X-Sprintelex-Signature |
| allowed_updates | array | No | filtered to known types; the only known type in v1 is 'message' |
| max_connections | integer | No (default 40) | clamped to 1-100 |
| drop_pending_updates | boolean | No | when true, undelivered poll updates are marked delivered_poll=true (they will not be returned by getUpdates afterwards) |
Response
{ ok: true, result: true }Rate limit: 10 calls per 60-second window per bot+env
Errors
| Status | Error | When |
|---|---|---|
| 429 | rate limit exceeded: slow down | more than 10 calls in 60 seconds |
| 400 | url is not a valid URL | url does not parse as a URL |
| 400 | webhook url must be https | non-https scheme |
| 400 | webhook url must not contain credentials | userinfo present in URL |
| 400 | webhook url must not target a private or loopback IP | literal IP host in a blocked range |
| 400 | webhook url must not target a local hostname | localhost/.local/.internal/.invalid host |
| 400 | webhook host resolves to a private or loopback IP | DNS A/AAAA records resolve private |
| 400 | secret_token must be at most 256 characters | secret_token longer than 256 |
| 500 | could not save webhook | DB upsert failed |