Setting up webhooks in the administrator's manual covers registering an endpoint, verifying a signature and how retries behave.
Osie outbound webhooks
Events this platform sends to registered endpoints.
Every delivery is a POST with a JSON body of the shape below. Deliveries are at-least-once and unordered: deduplicate on the webhook-id header, which is stable across retries of the same delivery. Answer 2xx within the response timeout to acknowledge; anything else is retried with backoff, and 410 Gone retires the endpoint.
When payload signing is enabled the request carries a webhook-signature header following the Standard Webhooks specification (https://www.standardwebhooks.com): HMAC-SHA256 over {webhook-id}.{webhook-timestamp}.{raw body}, base64, prefixed v1,. During a secret rotation the header holds several space-delimited signatures; accept the delivery if any one verifies.
NOTE ON THIS DOCUMENT'S SHAPE. These are events this platform SENDS to your endpoint — they are not operations you can call here. OpenAPI 3.0 has no place for outbound calls, so each event appears as a path whose POST body is the payload you will receive. The path is the event type, not a URL. Point your own handler at whatever URL you registered.
Authentication
- API Key: WebhookSignature
Standard Webhooks signature over the raw request body.
Security Scheme Type: | apiKey |
|---|---|
Header parameter name: | webhook-signature |