An event sent to a registered endpoint
Verify webhook-signature (v1, + base64 HMAC-SHA256 of {webhook-id}.{webhook-timestamp}.{body}
keyed by the base64-decoded secret after whsec_), refuse a timestamp more than 5
minutes off, and deduplicate on webhook-id. Answer 2xx within 15 seconds; anything
else is retried.
webhook-id*stringwebhook-timestamp*stringUnix seconds
webhook-signature*stringapplication/json- body
The body of every delivery. It names what changed, never a health value: read the data with the API. Signed per Standard Webhooks (headers webhook-id, webhook-timestamp, webhook-signature).
id*stringuuidtype*|stringtimestamp*stringdate-timetest?booleanPresent on events sent by the test route only. Such an event describes nothing that happened.
data*Accepted.
Example Requests
The body of every delivery. It names what changed, never a health value: read the data with the API. Signed per Standard Webhooks (headers webhook-id, webhook-timestamp, webhook-signature).
/event