Stable event contract · v1.0.0

Developer Webhooks

Owner-scoped JSON events with URL verification, signed raw bodies, at-least-once delivery, bounded retries, secret rotation, and 30-day delivery diagnostics.

v1.1.0 · 14 eventsv1.0.0 · 3 events

Delivery contract

  • HTTPS on port 443; redirects are rejected.
  • Five attempts with exponential backoff.
  • No ordering guarantee; deduplicate by event id.
  • Return any 2xx within 10 seconds.

Event catalog (3)

model.publishedA model owned by the endpoint owner became publicly available.
article.publishedAn article owned by the endpoint owner became publicly available.
feedback.status_changedA feedback case submitted by the endpoint owner changed status.

Verify the signature

Read the request body as bytes before JSON parsing. Reject timestamps older than five minutes. During the 24-hour rotation window the signature header can contain two v1 values; accept either.

X-AEC-Signature: t=1786147200,v1=<hex hmac>
signed = timestamp + "." + raw_request_body
expected = HMAC-SHA256(signing_secret, signed)

URL verification

When verification is requested, return the exact challenge:

{ "challenge": request.body.challenge }

Version identity

AsyncAPI 1.0.0

SHA-256 05689baf73d02398e9969ee7437980028d43fee9fef3080d9d452831787426b4

Download immutable contract →