Webhooks API

Objects

A webhook sends signed JSON events to your HTTPS endpoint. A delivery is one attempt to send one event: pending → delivered, or failed (retried after 1 min, 5 min, 30 min, 2 h and 6 h) and finally dead.

Events

order.created, order.updated, fill.created, violation.created, violation.updated, workflow.item.updated, workflow.sla_breached, feed.run.updated, sod.status, rule.activated, rule.retired, and ping.

Verify every delivery

Each request carries Vestoris-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256 of "t.body" with your secret>. Refuse a timestamp older than 5 minutes and compare in constant time:

import hmac, hashlib, time
def verify(secret: str, header: str, body: bytes) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    if abs(time.time() - int(parts["t"])) > 300: return False
    mac = hmac.new(secret.encode(), parts["t"].encode() + b"." + body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(mac, parts["v1"])

Answer 2xx quickly and process asynchronously; an event may arrive more than once (use event_id to deduplicate). More: Webhooks.

Typical sequence

POST /webhooks (store the secret: shown once) → POST /webhooks/{id}/ping → watch GET /webhooks/{id}/deliveries → POST …/redeliver after an outage.