Skip to main content
Webhooks are outbound requests to your receiver, not Akhdar REST paths. They are not authorized with X-API-Key. Akhdar delivers events to the HTTPS receiver configured for your environment.

Envelope

Every webhook contains:
  • event_id
  • delivery_id
  • event_type
  • event_version
  • timestamp
  • data

Verify signatures

Webhook requests include these required headers:
  • X-Akhdar-Signature
  • X-Akhdar-Timestamp
  • X-Akhdar-Event-ID
  • X-Akhdar-Delivery-ID
Compute HMAC-SHA256 over the exact X-Akhdar-Timestamp value, a period (.), and the exact raw request body bytes before JSON parsing or reformatting. The signature format is v1=<hex>. Accept timestamps only within five minutes before or after receipt.

Delivery behavior

Delivery is at least once, so duplicates are possible. Process events idempotently using event_id. Retries keep the same event_id and use a new delivery_id. Any HTTP 2xx response is successful; no response body is required. A 429 response is retried according to Retry-After. Transient 408, 5xx, and timeout failures are retried. Non-transient 4xx responses are not automatically retried.

Partner actions

Schemas and examples for every event are in API Reference.

Event payload

impact.transaction.confirmed