Webhooks

Receive signed, server-to-server callbacks for application events, with automatic retries and manual redelivery.

What webhooks are for

Webhooks are outbound, server-to-server callbacks from EmitWave to an endpoint you control. Where realtime channels push events to connected browsers, webhooks let your own backend react to application events without holding a socket open. They are configured per application through the management API.

Creating a webhook

Create a webhook with a bearer token scoped to the application. Configuration is CRUD under /api/platform/applications/{application}/webhooks.

curl -X POST \
  https://api.emitwave.com/api/platform/applications/<APP_ID>/webhooks \
  -H "Authorization: Bearer <API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{ "url": "https://example.com/hooks/emitwave" }'

See the Webhooks API for the full endpoint list, including listing deliveries and retrying a single delivery.

Signature verification

Webhook deliveries are signed so your endpoint can verify they came from EmitWave and were not tampered with in transit. Verify the signature before trusting the payload, and reject any request that fails verification.

Deliveries & retries

Each attempt is recorded as a delivery. Failed deliveries are retried automatically, and you can list a webhook's deliveries or trigger a manual retry of a specific delivery through the management API.

SSRF protection

Because webhook URLs are user-supplied, EmitWave guards outbound delivery against server-side request forgery — requests to internal or private network targets are refused. Point webhooks at a publicly reachable HTTPS endpoint.