Webhook: job.completed
POSTed to the job's registered webhook URL when the job completes. Delivery is at-least-once: dedupe on X-Hedra-Webhook-Id and verify X-Hedra-Webhook-Signature before acting.
Headers
Deduplication id: the job's own id (job_<uuid>), byte-identical across every retry and every replay. Signed.
Unix epoch seconds the delivery was signed at; reject it when more than 5 minutes old. Signed.
The event this delivery announces. Signed.
1-based attempt number within the current delivery cycle. Informational and outside the signature; do not branch on it.
true when an operator asked for this event to be sent again — process it even if its id was already recorded. Signed.
Hex-encoded ed25519 signature over the canonical string documented on the Webhooks tag; verify against the key from GET /webhooks/public-key before acting on the request.
Payload
Response
Acknowledged; any 2xx stops the retry ladder. Other responses are retried per the Webhooks tag.
Changes
Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.