What exists
| Channel | Configuration | Carries attachments |
|---|---|---|
| The workspace SMTP server, or ours; sender verifiable by domain | Yes | |
| Meta’s WhatsApp Cloud API: phone number id and access token | No — text and summary | |
| Telegram | Bot token; the bot has to be in the group or chat | No — text and summary |
| Webhook | URL, optional headers, and a secret for signing | Yes — the body is the result |
The WhatsApp integration uses Meta’s official Cloud API. Messages outside the 24-hour window need a template they approved — that is Meta’s rule, not ours.
Test before depending on it
Every channel has a test button that sends a real message and records the outcome — date, status, and the provider’s error when there was one. A channel that has never been tested is flagged in the list.
Webhook signature
When you set a secret, every POST carries an HMAC-SHA256 signature of the body in a header. Verify it before processing: without that, anyone who discovers the URL can inject a fake report into your system.