webhooks

Register a webhook (auth required; up to 3 per organization; https only)

Events token.verified / token.used / token.cancelled / token.transferred / queue.approaching are delivered as signed HTTPS POSTs (header x-rightos-signature: t=<unix seconds>,v1=<hex HMAC-SHA256(secret, ${t}.${rawBody})>). The signing secret (whsec_...) is returned only once in this response and is never stored server-side. Delivery is best-effort: 3s timeout, no retries — respond 2xx immediately and process asynchronously. Private/internal hosts are rejected (SSRF protection).

post/api/rightos/webhooks

Request

  • Base URL: https://rightos.i-s3.com
  • URL: https://rightos.i-s3.com/api/rightos/webhooks
  • Auth: one of:
    • apiKey (a scheme the document does not define)
    • bearer (a scheme the document does not define)

Request body

urlstring uri required

https URL (http allowed for localhost only)

eventsWebhookEventType[]

Defaults to all four events

Response

Created. The secret is returned only once.

secretstring

Signing secret (whsec_...). Shown only once; not retrievable later.

signatureHeaderstring
signatureFormatstring

Changes

No recorded changes to this operation across all 1 revision of this API.