Job settled
Sent to your webhook_url once a job settles, whether it succeeded or failed.
Answer 2xx as soon as you have the body, and do the work afterwards. A delivery that times out, or that is answered with a 5xx or a 429, is retried with the delay doubling between attempts; any other 4xx is read as a refusal and not retried. A redirect is not followed — register the address you want called.
Deliveries are at-least-once: an endpoint that is slow enough to time out is retried while it is still working on the first one. Make your handler idempotent on id.
Headers
When this delivery was signed, in whole seconds since the Unix epoch, written in digits only. Part of the signed material, and worth rejecting when it is old.
sha256= and the hex HMAC-SHA256 of <CV-Timestamp>.<body> under your signing secret. Absent when no secret is in place for your endpoint.
Payload
Response
Successful Response
Changes
Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.