Sent when a separation finishes and the stems are ready.

The instrumental and vocal tracks have been written to storage and the song is ready to download.

Delivered to every enabled endpoint subscribed to this event.

Verify the signature. Compute HMAC-SHA256(secret, timestamp + '.' + rawBody) as hex and compare it to the value in x-vocaless-signature (after the v1= prefix) using a constant-time comparison. Reject a x-vocaless-timestamp far from your own clock to prevent replay.

Deduplicate on x-vocaless-delivery. A delivery is retried up to 4 times (1m, 5m, 25m) until it gets a 2xx, and a worker that dies mid-request may resend one that already arrived.

Download URLs are deliberately absent: they are short-lived, so call GET /songs/{id} when you are ready to fetch the audio.

postWebhookseparation.completed

Headers

x-vocaless-signaturestring required

v1= followed by the hex HMAC-SHA256 of {timestamp}.{rawBody}.

x-vocaless-timestampstring required

Unix seconds. Part of the signed value, so reject anything far from your own clock to prevent replay.

x-vocaless-deliverystring required

Unique delivery id, stable across retries. Use it as your idempotency key.

Payload

idstring uuid required

Delivery id, same as the header.

type'separation.completed' required

created_atstring date-time required

Response

Any 2xx marks the delivery successful. Anything else is retried.

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.