# Flocks (webhook feeds) A flock is a read-only AbabilX chat that your apps post into through a secret webhook URL. It works from servers, scripts, automation tools and browsers on any site. A flock is a one-way chat. Anything that can send an HTTP POST can post into it: a deploy pipeline, a monitoring alert, a contact form, a cron job, Zapier, Make, n8n, or JavaScript on your own website. People in the flock read the messages, react to them and discuss each one in its thread. Nobody types into the flock itself. > **Same thing, three names.** The Android app calls it a Flock. The web app calls it a feed (New feed). The address you post to is the webhook URL. ## How a message travels 1. **POST to the webhook URL** (your app): JSON, or multipart with files. The secret in the URL is the only credential. 2. **Check the URL and limits** (our server): Unknown or replaced URL: 401. Too fast: 429. Bad body: 400. - _event_id seen in the last 7 days_ 1. **Store nothing** (our server): Answers 200 with duplicate: true. - _New message_ 1. **Store it** (our server): Files are saved, the message is written, answers 201. 4. **Members see it** (their device): Live in open apps, plus a push notification unless they muted the flock. _One POST becomes one message for every member._ ## Create a flock 1. Android: Chats → New → New flock. Web: the ⋯ menu above the chat list → New feed. 2. Type a name and, if you like, pick a picture. Both appear as the sender of every message. 3. Copy the webhook URL the moment it appears. Its shape is https:///hooks/chat//. 4. Store it somewhere safe, such as a secret store or an environment variable. > **The URL is shown once.** AbabilX keeps only a hash of the secret, so nobody can show the URL again, including us. Lost it? Generate a new one; the old one stops working that moment. ## Who can post Whoever holds the URL, from anywhere. The server does not care whether the request comes from a server, a phone, a laptop or a web page on another site: browsers may call the URL directly (it answers cross-origin requests from every origin, sends no cookies and needs no login). > **A URL in public code is a public URL.** If you call it from a web page, anyone who opens that page can read the URL and post too. That is fine for a contact form you are happy to receive spam on; for anything else, call it from your server. ## Who reads it | Who | Can | | --- | --- | | Owner (whoever created it) | Everything below, plus rename, change the picture, replace the URL, add and remove people, delete the flock. | | Admins | Same as the owner. | | Members | Read, react, and reply inside a message's thread. They cannot post at the top level. | | Your app | Post top-level messages through the URL. It cannot read anything back. | A new flock starts with only you in it. Add people from its details screen. ## Replace the URL Open the flock's details and choose Generate new URL. The previous URL answers 401 from that moment, so update whatever was posting to it. Do it whenever a URL may have leaked or someone who knew it left. ## What is kept, and for how long - Our server keeps the newest 10 messages of a flock, plus any that a signed-in device of a member has not received yet, plus any message that has a thread. - Members' phones keep their own copy of everything they received. - Files go when the message that held them goes. - An event_id is remembered for 7 days, per flock, to stop duplicates. > Flocks are not end-to-end encrypted. The server reads what your app posts so it can show it and send notifications. Do not post passwords, keys or anything you would not hand to a server. ## What a flock does not do - No outgoing events: replies and reactions are not sent back to your app. - No per-message sender name or avatar: every message uses the flock's name and picture. - No editing or deleting a posted message through the URL. - No HTML form posts (application/x-www-form-urlencoded). Send JSON or multipart. --- Source: https://chat.ababilx.com/docs/flocks Last updated: 2026-10-19