Sent when a separation fails. The charge is refunded automatically.
The run did not produce stems. The song goes back to uploaded so you can retry it, and the credits taken when the job was accepted have already been returned.
Delivered to every enabled endpoint subscribed to this event.
Verify the signature. Compute HMAC-SHA256(secret, timestamp + '.' + rawBody) as hex and compare it to the value in x-vocaless-signature (after the v1= prefix) using a constant-time comparison. Reject a x-vocaless-timestamp far from your own clock to prevent replay.
Deduplicate on x-vocaless-delivery. A delivery is retried up to 4 times (1m, 5m, 25m) until it gets a 2xx, and a worker that dies mid-request may resend one that already arrived.
Download URLs are deliberately absent: they are short-lived, so call GET /songs/{id} when you are ready to fetch the audio.
Headers
v1= followed by the hex HMAC-SHA256 of {timestamp}.{rawBody}.
Unix seconds. Part of the signed value, so reject anything far from your own clock to prevent replay.
Unique delivery id, stable across retries. Use it as your idempotency key.
Payload
Response
Any 2xx marks the delivery successful. Anything else is retried.
Changes
Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.