Reliable, signed and traceable events.

Receive changes to your operation without polling. Each delivery goes through the dedicated queue, saves attempts and carries a verifiable signature.

28 domain events

Sign them all with * or choose only the events that your application actually consumes.

offer.createdoffer.updatedoffer.archivedoffer.publishedsegment.createdsegment.updatedsegment.deletedcoupon.createdcoupon.updatedcoupon.archivedtemplate.createdtemplate.updatedtemplate.deletedschedule.createdschedule.updatedschedule.deletedschedule.executedmonitor.createdmonitor.updatedmonitor.deletedstore.updatedjourney.createdjourney.updatedjourney.deletedconversation.updatedconversation.closedconversation.repliedwebhook.test

Event-versioned schemes

Every envelope takes api_version. The catalog provides the schema URL and provides an example to validate consumers before publishing a change.

json

{
  "id": "evt_...",
  "type": "offer.updated",
  "api_version": "2026-08-31",
  "created_at": "2026-08-31T12:00:00.000Z",
  "data": { "offer_id": "off_..." }
}

Validate before processing

The secret appears only once. Calculate HMAC-SHA256 over the timestamp and the raw body and compare in constant time.

javascript

import { createHmac, timingSafeEqual } from "node:crypto";

const signed = `${timestamp}.${rawBody}`;
const expected = createHmac("sha256", process.env.ACHADU_WEBHOOK_SECRET)
  .update(signed)
  .digest("hex");
const received = signature.replace("sha256=", "");

if (!timingSafeEqual(Buffer.from(expected), Buffer.from(received))) {
  throw new Error("Invalid signature");
}

Durable delivery

Queue independent of the web process.

Up to six attempts for transient failures.

Timeout of 12 seconds per attempt.

History with HTTP status, error and time.

Internal destinations and private addresses are blocked.

Webhook Inspector

In the Developers area, open a delivery to check payload, target response, HTTP status, duration, attempts and next retry. The same panel allows you to copy the event and queue a resend.

Raw body preserved for debugging.

Limited response and no secrets.

Duration measured per attempt.

Resend creates a new delivery linked to the same event_id.