Webhooks

Overview

Webhooks allow you to receive real-time HTTP payloads whenever specific events occur in your Delivami workspace. Instead of constantly polling our API, we push the data directly to your server.

Setting Up Webhooks

1. Go to Settings > Integrations > Webhooks.
2. Click Add Webhook.
3. Enter your destination Endpoint URL (must be publicly accessible and use HTTPS).
4. Select the specific events you want to subscribe to.
5. Save the webhook. You will immediately be issued a Webhook Secret used for verifying the authenticity of incoming payloads.

Common Events

• project.created: Triggered when a new project is created.
• delivery.sent: Triggered when a delivery is submitted to a client.
• delivery.approved: Triggered when a client approves a delivery.
• invoice.paid: Triggered when a payment clears successfully.

Verifying Webhooks

For security, you should verify that incoming webhook requests actually originate from Delivami. Every webhook includes an X-Delivami-Signature header.

You can verify the signature by computing an HMAC-SHA256 hash of the raw request body using your Webhook Secret, and comparing it to the signature in the header.

const crypto = require('crypto');

function verifyWebhook(rawBody, signatureHeader, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');
    
  return crypto.timingSafeEqual(
    Buffer.from(signatureHeader),
    Buffer.from(expectedSignature)
  );
}

Retry Logic

If your endpoint fails to return a 2xx HTTP status code within 10 seconds, Delivami will assume the delivery failed and will attempt to retry using an exponential backoff strategy:

• 1st retry: 5 minutes
• 2nd retry: 30 minutes
• 3rd retry: 2 hours
• 4th retry: 12 hours

If a webhook fails repeatedly, it will be automatically disabled to protect system resources.

Next Steps

• Manage API Keys