Events (automations)

​

Available events

{
  "eventId": "evt_6a0c…",
  "name": "message.replied",
  "timestamp": "2026-09-30T10:05:00.000Z",
  "cursor": null,
  "data": {
    "conversationId": 81234,
    "messageId": 99120,
    "messageType": "LINKEDIN",
    "content": "Tuesday works — send me an invite.",
    "subject": null,
    "sentAt": "2026-09-30T10:04:58.000Z",
    "contact": { "id": 4412, "firstName": "Ada", "lastName": "Lovelace", "jobTitle": "CTO", "…": "…" },
    "campaign": { "id": 310, "name": "Q4 CTO outreach", "status": "ACTIVE" }
  }
}

​

Who can use events

• OAuth connections only. Events belong to the person who connected the MCP client. Sessions authenticated with a static API key, and sessions with an active readonly impersonation, do not advertise the events capability.
• Scope: the connection needs MESSAGING_READ, and the workspace MCP policy must allow it.
• Row-level access is enforced per event. A user restricted to specific identities only receives events for conversations they can see in the app, and a campaignId filter must be a campaign they can see.
• Access is re-checked before every delivery attempt, including events already queued or being retried: revoking the MCP connection, deactivating the user, losing access to the conversation, or pausing the workspace MCP policy stops delivery immediately. A subscription made while switched to another account through a multi-user account also stops if the connecting user or their own workspace loses MCP access, or their permission to switch accounts is revoked.

​

Delivery details

• Methods: events/list, events/subscribe (webhook delivery only) and events/unsubscribe. The server declares capabilities.events on server/discover.
• Verification: before a subscription activates, Enginy POSTs {"type":"verification","challenge":"…"} to the callback URL; the endpoint must answer 2xx with {"challenge":"…"}. A callback verified with the same secret is not re-challenged for 24 hours; a new or rotated secret is always challenged again.
• Signing: every request follows Standard Webhooks — webhook-id (the eventId), webhook-timestamp, webhook-signature (HMAC-SHA256 with the whsec_ secret from events/subscribe) and X-MCP-Subscription-Id. After a secret rotation, requests are signed with both the new and the previous secret for 15 minutes.
• Retries: failed deliveries are retried with exponential backoff for about two hours with the same eventId. Only 410 Gone and 413 are treated as final: they are not retried, and 410 deactivates the subscription until the client subscribes again.
• Limits: callback URLs must be public https URLs (no redirects are followed); up to 50 active subscriptions and 20 callback verifications per hour per user; subscriptions expire after the granted refreshBefore (default 7 days, at most 30) unless refreshed; event bodies stay under 256 KiB (long message bodies are truncated and flagged with contentTruncated).
• No replay: events are not replayable; cursor is always null.