Webhooks
Signed deliveries, retries, replay and the event catalog.
Register an endpoint with POST /webhook_endpoints (https only, public addresses only). The
signing secret is returned once; rotate it with POST /webhook_endpoints/{id}/secrets, after
which the previous secret verifies for 24 hours.
Each delivery is a POST with headers Orishare-Signature: t=<unix>,v1=<hex>,
Orishare-Delivery-Id, Orishare-Event-Id and Orishare-Event-Type. Verify with
HMAC-SHA256(secret, "<t>.<raw body>") and reject timestamps older than five minutes; the client
library exports verifyWebhookSignature. Dedupe on Orishare-Event-Id: delivery is at least once
and replays reuse the same id.
Failures retry with exponential backoff for about 24 hours; endpoints failing for a day are
disabled and can be re-enabled with PATCH. GET /webhook_deliveries shows attempts, status codes
and the captured response snippet; POST /webhook_deliveries/{id}/replay sends the same envelope
again; POST /webhook_deliveries with an endpoint_id sends a webhook.test ping.
Catalog
customer.created, customer.updated, points.awarded, points.deducted, points.expired,
points.reversed, tier.changed, reward.issued, reward.redeemed, challenge.progressed,
challenge.completed, rule.executed, webhook.endpoint.disabled, plus any custom name a
webhook.emit action sends. Subscribe with subscribed_types, or ["*"] for everything.