Webhooks in

Method	Path	Auth
POST	/v1/webhooks/whatsapp/forward	API key — forward Meta's WhatsApp webhook payload (the whole envelope, or a single { value }) if your Meta app's webhook must keep pointing at your own backend. Only payloads for your own channels are processed. Idempotency-Key is ignored here.
GET	/webhooks/whatsapp	Meta's subscription check: with hub.mode=subscribe and hub.verify_token equal to the configured verify token, replies with hub.challenge as text; otherwise 403.
POST	/webhooks/whatsapp	Meta posts directly, signed with X-Hub-Signature-256 — point a Meta app's webhook straight at Calloop. 401 on a bad signature, 404 not_enabled when no app secret is configured.

Both POSTs answer 200 { received: n } (n = call-related changes in the payload) before processing, or 503 while the worker is shutting down so Meta redelivers.