API

Enqueue a signed delivery

Fully API. Create an endpoint in the dashboard, then POST events. We attach an HMAC-SHA256 signature, retry on a published backoff, and honor idempotency keys.

POST /api/v1/events

curl -X POST $ORIGIN/api/v1/events \
  -H "Authorization: Bearer wm_live_…" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: inv_paid_1042" \
  -d '{
    "event_type": "invoice.paid",
    "endpoint_id": "ep_…",
    "data": { "invoice_id": "inv_1042", "amount": 4900 }
  }'

Signature

We send Webhookmill-Id, Webhookmill-Timestamp, Webhookmill-Event, and Webhookmill-Signature as t=<unix>,v1=<hex>. The hex is HMAC-SHA256 of timestamp.rawBody using the endpoint secret.

const crypto = require("crypto");
const [t, v1] = Object.fromEntries(
  header.split(",").map((p) => p.split("="))
);
const expected = crypto
  .createHmac("sha256", WHSEC)
  .update(`${t}.${rawBody}`)
  .digest("hex");

Retries

Starter and Pro: 5 attempts at 0s · 15s · 1m · 5m · 30m. Scale adds 2h · 12h · 24h. Non-2xx and network errors retry. Replay from the dashboard clones the payload onto a new delivery.