Webhooks

Signed events are the backbone of the current developer program.

Asteri already supports signed webhook delivery with retries, delivery tracking, and endpoint management. This section turns that in-product capability into a public reference surface.

Signed payloads

Deliveries are signed with HMAC-SHA256 and expose the X-Webhook-Signature header.

Automatic retries

Non-2xx or timed-out deliveries retry automatically with exponential backoff. Endpoints with repeated failures are flagged for attention.

Operable by default

Endpoint activation, delivery history, replay workflows, and secret rotation belong in the portal, not buried in an admin-only corner.

Event catalog

Customers

customer.createdcustomer.updatedcustomer.deleted

Appointments

appointment.createdappointment.updatedappointment.completedappointment.cancelled

Invoices

invoice.createdinvoice.updatedinvoice.sentinvoice.paid

Estimates

estimate.createdestimate.updatedestimate.sentestimate.acceptedestimate.declined

Verification

1. Capture the raw request body before JSON parsing.

2. Compute an HMAC-SHA256 digest with the endpoint signing secret.

3. Compare it against the signature header and reject on mismatch.

Example payload

{
  "event": "customer.created",
  "timestamp": "2026-03-20T14:30:00Z",
  "data": {
    "id": "uuid",
    "organization_id": "uuid"
  }
}