Outbound webhooks

Signed raw body

Read the signature header, extract its timestamp and signature, and compute the HMAC over the timestamp, a dot, and the exact raw request body. Compare in constant time and reject stale timestamps. Verify before parsing or processing the event.

x-evnao-signature: t=TIMESTAMP,v1=HEX
HMAC-SHA256(secret, timestamp + "." + rawBody)

Delivery and retries

Return a 2xx response within 10 seconds after safely accepting the event. Deliveries retry with exponential backoff and stop after eight attempts. Twenty consecutive endpoint failures disable the endpoint; a successful delivery resets its failure count.

x-evnao-delivery — Use the delivery ID to avoid processing the same delivery twice. Save it durably with your processing result. A retry can arrive after your server accepted an event but its response was lost.

Network boundary

Use a direct public HTTPS URL. DNS is checked at setup and on delivery. Private, loopback, link-local and credential-bearing destinations are rejected. Delivery does not follow redirects, including redirects on the same domain.

Available events

• ticket.created
• ticket.updated
• message.created
• conversation.rating.created
• knowledge.article.created
• knowledge.article.updated

Internal notes are excluded from message.created. The envelope fields are id, type, createdAt and data. Event names and header names stay unchanged in every language.

Set up and check delivery

1. Add your endpoint and choose only the events you need. Save the signing secret in your server’s secret store and configure verification before enabling processing.
2. Review delivery status and safe errors in API settings. A queued test is not proof of delivery; confirm the received event and the delivery result.
3. When rotating the signing secret, update your receiver promptly. New delivery attempts use the current secret; Evnao does not provide an old-secret overlap window.