Everything worth knowing, nothing that isn't.
What events it delivers
The two most common are delivery receipts (DLRs), which report whether each message reached the handset and why it failed, and inbound messages, which let you build two-way flows and STOP handling. See /answers/what-is-dlr and /answers/what-is-mo-vs-mt.
Why push beats polling
Polling an API for status wastes requests and adds latency; a webhook delivers the event the moment it occurs, so your OTP retries, support routing, and analytics react in real time. See /developers/webhooks.
Verify and secure it
Because anyone can POST to a public URL, sign webhook payloads (for example with HMAC-SHA256) and verify the signature before trusting an event, and always serve the endpoint over HTTPS. See /answers/hmac-sha256-dlr-signing and /tools/webhook-signature-validator.
Make it resilient
Return a fast 2xx and process asynchronously, expect retries and occasional duplicates (so handle events idempotently), and monitor for failures so you never silently miss a delivery event. See /developers/webhooks.