Webhooks

Supported events

Event	Triggered when
api_key.created	A new API key is issued for a Developer App
api_key.revoked	An API key is revoked
quota.exceeded	A request is rejected due to rate limit
portal.published	A portal build completes
tenant.provisioned	A new tenant is created (admin only)

Registering a webhook

curl -X POST $API_URL/v1/webhooks \
  -H "Authorization: Bearer $API_KEY" \
  -d '{"url": "https://your-service.example.com/webhooks", "events": ["quota.exceeded"]}'

Verifying the signature

Every webhook payload is signed with HMAC-SHA256. Verify before processing:

import { createHmac } from "crypto";

function verify(payload: string, signature: string, secret: string): boolean {
  const expected = createHmac("sha256", secret).update(payload).digest("hex");
  return signature === `sha256=${expected}`;
}