Webhooks

Webhooks deliver signed, real-time events to an HTTPS endpoint you register — enrollments, bookings, certificates, payments, and more. They're the push companion to the queryable Event Stream.

1. Register an endpoint

curl -X POST https://api.dwrrah.com/v1/webhooks/endpoints -H "Authorization: Bearer dwr_live_…" -H "Content-Type: application/json" -d '{"url":"https://example.com/dwrrah/webhook","events":["session.booked","payment.succeeded"]}'

The response includes the signing secret (whsec_…) once — store it immediately. The URL must be public HTTPS.

2. Verify every delivery

Before trusting a payload, verify the Dwrrah-Signature header. It's a comma-separated list of v1=<hex> HMAC-SHA256 signatures over Dwrrah-Timestamp + "." + raw_request_body, keyed by your signing secret. Compute the same HMAC and compare. During a secret rotation's 24-hour grace window, the list carries both the new and previous secret's signature.

Common event types

Manage & debug

• Rotate secret — a new secret is returned once; the previous one stays valid for a 24h grace window.
• Test — send a sample event to your endpoint.
• Deliveries — inspect attempts and statuses, and retry failed deliveries.