Create a webhook endpoint (Silver and up)

Subscribe a URL to funding-round alerts. When a new funding round lands for a company on your watchlist (list_id — one of your saved company lists), or any company if unscoped, Indexed POSTs a signed JSON event to your endpoint within ~5 minutes.

Billing: 1 credit per successfully delivered event. Test sends and retries are free; a delivery is never charged twice (idempotent per delivery id). Deliveries pause if your credits are exhausted and resume on the retry schedule once topped up.

Delivery + retries: 10s timeout, HTTPS only, redirects refused. Non-2xx responses retry on a backoff of 1m → 10m → 1h → 6h → 24h, then dead-letter. 20 consecutive failures auto-disable the endpoint (re-enable via PATCH is_active: true).

Delivery semantics — at-least-once. Like Stripe/GitHub webhooks, an event may occasionally be delivered more than once (e.g. your endpoint 200s but the ack is lost, or a worker is reclaimed after a crash). Dedupe on X-Indexed-Delivery-Id — process each id once. Billing is exactly-once regardless: a given delivery is charged at most one credit even if re-sent (idempotent per delivery id).

Verifying signatures: every request carries X-Indexed-Signature: t=<unix_seconds>,v1=<hex> where v1 = HMAC_SHA256(secret, "{t}.{raw_body}"). Recompute over the raw body, compare constant-time, and reject if |now - t| > 300s:

const [t, v1] = header.match(/t=(\d+),v1=([0-9a-f]+)/).slice(1)
const expected = crypto.createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex')
const valid = crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1))
  && Math.abs(Date.now()/1000 - t) < 300

Requests also carry X-Indexed-Event and X-Indexed-Delivery-Id (use the delivery id for idempotent processing on your side).

Event catalog — funding_round.created (new round, announced ≤90 days), funding_round.updated (material correction to an existing round, ≤1/round/day), company.created / investor.created (entity entered the visible index, fired once), and company.updated (watchlist-scoped subscriptions only — requires list_id; ≤1/company/day). domain.coverage.added is opt-in and fires once per endpoint/domain when a domain previously missed by that user becomes API-resolvable. company.* payloads carry data.company, investor.* payloads carry data.investor; the funding shape is below.

Coverage-added payload (domain.coverage.added):

{
  "id": "<delivery uuid>",
  "event": "domain.coverage.added",
  "created_at": "2026-09-01T12:00:00Z",
  "data": {
    "requested_domain": "example.com",
    "company": { "id", "name", "slug", "website", "industries", "hq_city", "hq_country" },
    "domain_match": {
      "queried": "example.com",
      "canonical_domain": "example.com",
      "matched_via": "canonical_domain"
    }
  }
}

Event payload (funding_round.created / funding_round.updated):

{
  "id": "<delivery uuid>",
  "event": "funding_round.created",
  "created_at": "2026-07-03T12:00:00Z",
  "data": {
    "company": { "id", "name", "slug", "website", "industries", "hq_city", "hq_country" },
    "funding_round": {
      "event_type": "series_b", "round_name": "Series B",
      "amount_raised_usd": 42000000, "announced_date": "2026-07-01",
      "post_money_valuation": 400000000, "press_url": "https://…",
      "investors": [{ "name": "Example Ventures", "is_lead": true }]
    }
  }
}

Endpoint limits: Silver 2, Gold 3, Platinum 10, Enterprise 25.