Webhooks

Webhook handling is documented for approved private-beta event-delivery pilots. Quote, order, and workflow webhooks are not public-current production enablements for every Partner API key.

---

Availability

• webhook management requires an active registry key with webhooks:manage
• event delivery depends on contract, entitlement, and rollout state
• API key format alone does not enable webhook traffic
• RFQ/quote/order automation must also be present in the published contract before public client use

---

Delivery basics

• HTTPS only
• signed requests
• durable at-least-once delivery with bounded retry and dead-letter terminal state
• retry on timeout or non-2xx response; a failed persistence write is not reported as success
• idempotent consumer design recommended

Subscriptions and delivery rows are tenant-scoped. Each delivery is addressed by the source event ID and subscription ID, so enqueue replay returns the same durable delivery instead of creating a second one. Dispatch uses an expiring lease and a lease token; a stale worker cannot acknowledge or retry a newer claim. Malformed legacy rows are ignored fail-closed. Delivery may be pending, leased, retrying, success, or terminal failed.

---

Event families

Event family	Example events	Current posture
Quote lifecycle	quote.received, quote.updated	Private-beta / rollout controlled
Order lifecycle	order.created, order.confirmed, order.shipped	Private-beta / rollout controlled
Workflow signals	partner-specific operational events	Contract-specific

The exact event set depends on entitlement and rollout posture.

---

Example payload shape

{
  "id": "evt_01js3q7d9w4b2k8m1z0h3v6x7y",
  "event": "quote.received",
  "timestamp": "2026-04-16T10:00:00.000Z",
  "data": {
    "rfqId": "rfq_123456",
    "quoteId": "quote_987654"
  }
}

---

Signature verification

import crypto from 'node:crypto';

export function verifyWebhookSignature(rawBody: string, signature: string, secret: string) {
  const digest = crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
  return signature === `sha256=${digest}`;
}

Verify the raw body before JSON parsing or business logic. The delivery also carries the Standard Webhooks headers, including the delivery ID, timestamp and signature. Verify the exact raw body and canonical headers before parsing. Webhook secrets are never written to logs. Redirects, non-HTTPS URLs and private-network targets are rejected by the dispatcher.

---

Consumer guidance

• return 2xx quickly after verification and enqueue heavier work
• store delivery IDs to keep processing idempotent
• log request IDs and event IDs
• rotate webhook secrets on a regular cadence
• keep consumers tolerant of event families that are not enabled for your rollout

This remains a private-beta, entitlement- and rollout-controlled capability; this page is not a public production GO declaration.

---

Related docs