Skip to main content

Webhooks

Overview

Register HTTPS webhook endpoints, subscribe to the supported event catalog, and receive signed organization-scoped events.

Endpoints

  • GET /api/v1/webhooks/events — discover supported event subscriptions
  • GET/POST /api/v1/webhooks/endpoints — manage endpoints; endpoint reads do not return signing secrets
  • POST /api/v1/webhooks/endpoints/{id}/rotate-secret — rotate an endpoint secret and return the replacement once
  • POST /api/v1/webhooks/process — process incoming events (internal)
  • GET /api/v1/webhooks/status — scoped delivery history
  • POST /api/v1/webhooks/deliveries/{attemptId}/replay — queue a controlled replay to an active endpoint

Every delivery has an X-AidOrbit-Signature HMAC-SHA256 signature over the raw body. Store received envelope IDs for idempotency: automatic retries and controlled replays can deliver the same event again.

Examples

curl -X POST "{{baseUrl}}/api/v1/webhooks/endpoints" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"name":"Attendance sync","url":"https://example.com/webhook","events":["shift.checkin"]}'

See also