Webhooks
Get told when an agent finishes, fails, or needs a decision.
A webhook posts to a URL you own when something happens in your workspace.
Verifying it came from us
Every delivery is signed. The signature is an HMAC of the timestamp and the body using the signing secret shown once when you create the endpoint.
Verify it, and compare in constant time. An endpoint that accepts any POST is an endpoint anybody can post to.
The timestamp matters
Reject a delivery whose timestamp is more than a few minutes old, even with a valid signature. Without that check, a captured request can be replayed at any point in the future and still verify.
Retries and duplicates
Failed deliveries are retried with a backoff. That means you will occasionally receive the same event twice — a network failure after we sent it but before we saw your response looks identical to a failure.
Every event carries an id. Record the ones you have processed and ignore repeats. Do not rely on receiving each event exactly once, because no webhook system anywhere can promise that.
Respond quickly
Answer 2xx as soon as you have stored the event, then do the work. A handler that does five seconds of processing before responding will eventually time out and be retried while the first one is still running.