CreateWebhookInput

Register an endpoint to receive outbound event deliveries.

Delivery contract

Each delivery is a POST of a JSON body carrying the event's fields plus an eventType key naming the event.

| Header | Value | |---|---| | X-Kesk-Event | the event's wire name, e.g. order.created | | X-Kesk-Signature | HMAC-SHA256(secret, raw_request_body), lowercase hex, no prefix |

Verify by HMAC-ing the bytes as received, not a re-serialisation of the parsed body — re-encoding changes key order and whitespace and the signature will not match. Compare in constant time.

Requests time out after 10 seconds. A delivery is attempted at most 3 times, retrying 30 seconds after the first failure and 5 minutes after the second. A non-2xx response, a timeout and a transport error all count as failures. Redirects are not followed.

Once a delivery has used up its attempts the webhook is disabled and stops receiving events until it is re-enabled. Every attempt is recorded with its request body, its response status and the failure reason; response bodies are not retained.

The signing secret is not returned when a webhook is registered. Call regenerateWebhookSecret once afterwards to obtain it — that is the only time it is shown.