The moment it happens,
your server knows
Moderation events pushed to your server the moment they happen: spam detections, bans, joins and more — each delivery HMAC-signed, deduplicated and retried on a schedule until your endpoint confirms it.
- Events in real time
- HMAC-signed payloads
- Retries until delivered
Seven events, straight from the engine
Subscribe per endpoint to exactly the events you need — from spam verdicts to membership changes.
spam.detectedmessage.suspicioususer.banneduser.kickeduser.muteduser.joineduser.leftEvery event ships in a compact JSON envelope: id, type, created_at, group_id and the event data — the id stays stable across retries, so deduplication is one set lookup.
The retry schedule, exactly as it runs
Six attempts over roughly eight hours — enough to ride out a deploy, a restart or a full outage on your side.
0Instant+1m+5m+30m+2h+6hFinal attemptDelivery you can build on
At-least-once delivery
Every event is delivered at least once. Your endpoint confirms with any 2xx — anything else goes back to the retry queue.
Stable ids for dedup
Each event has a stable id that survives retries. Deduplication on your side is a single lookup, not a heuristic.
No zombie endpoints
An endpoint failing for days gets disabled automatically — and you get a Telegram DM instead of a silent gap in your data.
Test ping
A one-click test event, signed like the real thing — verify your handler before a single real event depends on it.
Inspectable history
Full delivery history per endpoint: every attempt, status and timestamp — debugging your receiver never involves guesswork.
HTTPS only, always signed
Endpoints must be public HTTPS URLs, and every payload is signed. Transport and authorship are both covered.
Verify every delivery
Three lines on your side — and no one can forge or replay an event.
# X-Telm-Signature: v1=<hex>
expected = hmac_sha256(secret, timestamp + "." + body)
valid = constant_time_eq("v1=" + hex(expected), header)Push, don't poll
Polling an API tells you what happened when you asked; webhooks tell you the moment it happens. Register an HTTPS endpoint, pick the events you care about, and Telm starts pushing them to your server as JSON — a spam wave, a ban, a raid of joins — the second the engine acts.
Every delivery is signed. The X-Telm-Signature header carries an HMAC-SHA256 of the timestamp and body computed with your endpoint's secret, so your server can verify both authorship and freshness in three lines of code. Payloads travel over HTTPS only.
Delivery is engineered for the real internet, where receivers go down. Events are delivered at-least-once with a stable id for deduplication; failures retry on a growing schedule — immediately, then after 1 and 5 minutes, 30 minutes, 2 and 6 hours. An endpoint that keeps failing for days gets disabled automatically, and you get a Telegram message about it instead of a silent gap.
Everything is inspectable: send a test ping before going live, and browse the delivery history — attempt by attempt, status by status — whenever you need to debug your side of the pipe.
Frequently asked questions
How do I verify that an event really came from Telm?
Each delivery carries an X-Telm-Signature header: an HMAC-SHA256 of "timestamp.body" computed with your endpoint's secret. Recompute it on your side, compare in constant time, and reject anything older than a few minutes to rule out replays.
What happens if my server is down when an event fires?
Telm retries on a growing schedule — immediately, then after 1 minute, 5 minutes, 30 minutes, 2 hours and 6 hours. Any 2xx response counts as delivered. Events carry a stable id, so a retry never becomes a duplicate in your system.
Can a broken endpoint flood forever?
No. An endpoint that fails around twenty times in a row with no success for three days is disabled automatically, and you get a Telegram notification. Fix your side and re-enable it in one click.
How do I test my integration before going live?
Send a test ping to any endpoint straight from the dashboard or the API — it arrives signed exactly like a real event. The delivery history shows every attempt with its status.
Which plans include webhooks?
Webhooks are part of the full API package, included in Pro and Business plans.
Related features
Explore more ways Telm can help your community