Webhooks

Register an HTTPS URL and subscribe to registry events; we POST when they happen. Delivery is retried on backoff 1m / 5m / 30m / 2h. After the fourth failure the webhook auto-disables so a customer sees why nothing is arriving rather than a silent stall.

Manage

POST https://firmatal.dk/api/webhooks Create a webhook. Returns the secret exactly once.

GET https://firmatal.dk/api/webhooks List your webhooks.

DELETE https://firmatal.dk/api/webhooks/{id} Delete a webhook.

POST https://firmatal.dk/api/webhooks/{id}/test Fire a signed test delivery through the real pipeline.

GET https://firmatal.dk/api/webhooks/{id}/deliveries The last 50 attempts, with status and response code.

Signature

X-Signature is HMAC-SHA256(timestamp . delivery_id . body, webhook_secret), hex-encoded. X-Timestamp and X-Delivery-Id travel alongside for replay protection and idempotency. Same shape as Stripe's webhooks, so an existing integration guide translates.

expected = hmac_sha256(request.headers['X-Timestamp']
                       + request.headers['X-Delivery-Id']
                       + request.body,
                       webhook_secret)
if !constant_time_equals(expected, request.headers['X-Signature']):
    reject