Skip to main content
Webhooks are outbound requests to your receiver, not Akhdar REST paths. They are not authorized with X-API-Key. Akhdar delivers events to the HTTPS receiver configured for your environment.

​
Envelope

Every webhook contains:
  • event_id
  • delivery_id
  • event_type
  • event_version
  • timestamp
  • data

​
Verify signatures

Webhook requests include these required headers:
  • X-Akhdar-Signature
  • X-Akhdar-Timestamp
  • X-Akhdar-Event-ID
  • X-Akhdar-Delivery-ID
Compute HMAC-SHA256 over the exact X-Akhdar-Timestamp value, a period (.), and the exact raw request body bytes before JSON parsing or reformatting. The signature format is v1=<hex>. Accept timestamps only within five minutes before or after receipt. During an overlap window, current and previous signing secrets only (max two) may verify.

​
Delivery behavior

Delivery is at least once, so duplicates are possible. Process events idempotently using event_id. Retries keep the same event_id and use a new delivery_id. Any HTTP 2xx response is successful; no response body is required. A 429 response is retried according to Retry-After. Transient 408, 5xx, and timeout failures are retried. Non-transient 4xx responses are not automatically retried.

​
Partner actions

Schemas and examples for contribution and settlement events are in the API Reference under Webhooks. For environmental.status.updated event version 2, see Planting fulfilment batch webhooks.