Webhooks¶
A move changed state¶
POST your receiver
Posted to the move's callback_url, else to the account's receiver, at least once per
state change (deduplicate by X-Lokadb-Delivery). Retried until your receiver answers
2xx: after 5 s, then doubling up to an hour between tries, for 24 hours.
Set the account's receiver (PUT /v1/accounts/{a}/webhook) first even when you give
each move its own callback_url: its secret signs every delivery of the account.
Signature. X-Lokadb-Signature: sha256=<hex> is HMAC-SHA256 with your webhook
secret over <X-Lokadb-Timestamp>.<body> (the timestamp, a dot, the raw body). Compute
it over the raw bytes before parsing, compare in constant time, and refuse a timestamp
older than 5 minutes.
Parameters
| Name | In | Type | Description |
|---|---|---|---|
X-Lokadb-Timestamp (required) |
header | string | Unix seconds. |
X-Lokadb-Signature (required) |
header | string | sha256= and the hex HMAC. |
X-Lokadb-Delivery |
header | string | The delivery's id (the same on its retries). |
Body (application/json): WebhookBody
| Field | Type | Description |
|---|---|---|
type (required) |
string: move.state |
|
id (required) |
string | The move. |
org (required) |
integer | |
tenant |
string | |
external_ref |
string | |
state (required) |
MoveState | |
previous |
string | |
phase |
string | |
error |
string | |
at (required) |
string (date-time) |
Responses
| Status | Description | Body |
|---|---|---|
200 |
Taken. Any 2xx counts. |