Stable event contract · v1.1.0
Developer Webhooks
Owner-scoped JSON events with URL verification, signed raw bodies, at-least-once delivery, bounded retries, secret rotation, and 30-day delivery diagnostics.
Delivery contract
- HTTPS on port 443; redirects are rejected.
- Five attempts with exponential backoff.
- No ordering guarantee; deduplicate by event
id. - Return any
2xxwithin 10 seconds.
Event catalog (14)
model.publishedA model owned by the endpoint owner became publicly available.model.version.publishedA version of a model owned by the endpoint owner became publicly available.image.publishedAn image owned by the endpoint owner became publicly available.video.publishedA video owned by the endpoint owner became publicly available.article.publishedAn article owned by the endpoint owner became publicly available.collection.createdA collection owned by the endpoint owner was created.collection.updatedA collection owned by the endpoint owner changed.collection.deletedA collection owned by the endpoint owner was deleted.generator.job.completedAn image generator job owned by the endpoint owner completed successfully.generator.job.failedAn image generator job owned by the endpoint owner failed or was cancelled.generator.video_job.completedA video generator job owned by the endpoint owner completed successfully.generator.video_job.failedA video generator job owned by the endpoint owner failed.generator.video_job.cancelledA video generator job owned by the endpoint owner was cancelled.feedback.status_changedThe status of a feedback case submitted by the endpoint owner changed.Verify the signature
Read the request body as bytes before JSON parsing. Reject timestamps older than five minutes. During the 24-hour rotation window the signature header can contain two v1 values; accept either.
X-AEC-Signature: t=1786147200,v1=<hex hmac> signed = timestamp + "." + raw_request_body expected = HMAC-SHA256(signing_secret, signed)
URL verification
When verification is requested, return the exact challenge:
{ "challenge": request.body.challenge }Version identity
AsyncAPI 1.1.0
SHA-256 4f77c9127eef06ebf5ce39397e2402e67d2f5d7b64a5684885204cf5b5d85736