Batch events
Sent once per batch when it reaches its final status, usually within a minute, to each enabled webhook that lists the event. The events are batch.completed, batch.failed, batch.expired (the 24 hour completion window ended first) and batch.cancelled. A batch that reached its final status more than 24 hours before it is picked up sends none. Listing a batch event needs batch read access.
Headers
sha256= followed by the lowercase hex HMAC-SHA256 of the raw request body. The HMAC key is the 64 character lowercase hex SHA-256 of your whole whsec_ secret, prefix included, used as those characters rather than decoded from hex. Verify it over the exact bytes received, before parsing them. Only the body is signed: there is no timestamp. The signing secret is read at each attempt, so a retry after a regenerate is signed with the new secret.
The event's type, the same as the body's type.
The id of this delivery to this webhook, a UUID. Every retry of the delivery carries the same id and the same body, so deduplicate on it.
The same value as X-OpenRelay-Signature, under the name used before OpenRelay. Deprecated, to be removed in a future release: verify X-OpenRelay-Signature.
The same value as X-OpenRelay-Event. Deprecated, to be removed in a future release: read X-OpenRelay-Event.
The same value as X-OpenRelay-Delivery. Deprecated, to be removed in a future release: read X-OpenRelay-Delivery.
Payload
Response
Delivered. Any 2xx status within 10 seconds counts, and its body is not kept.
Changes
Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.