Webhooks — signed event delivery

Delivery is live. Register an endpoint, pick from seven event types, and untactit signs every payload with HMAC-SHA256 over the timestamp and body. At-least-once delivery, exponential backoff for up to 24 hours, automatic disable after 48 hours of failure. Endpoints must be https, and private or loopback addresses are refused both at registration and at send time.

Push or pull

Pick whichever fits.

Webhooks are the right tool when you need to react in seconds — revoke a deployment, page someone, open a ticket the moment drift appears.

For a nightly compliance sync or a dashboard refresh, polling the audit log is still perfectly reasonable. It is queryable by actor, action, and time range, and it costs you nothing to keep using it alongside webhooks.

Audit log and export

Event types — 7

asset.proposed

Editor submits for approval

asset.approved

Approver accepts, asset goes live

asset.rejected

Sent back with a note

deployment.completed

All targets confirmed

deployment.failed

One or more targets rejected it

drift.detected

Local copy diverged from approved

member.role_changed

Admin granted or revoked a role

Committed design

Signed, and safe to replay.

Every request will carry X-Untactit-Signature — an HMAC-SHA256 of the raw body — plus a timestamp. Verify both: signature proves it came from us, timestamp stops an old request being replayed at you.

✓Timestamps older than 5 minutes are rejected
✓Compare signatures in constant time, never with ==
✓Up to 5 endpoints per workspace

verify.py

import hmac, hashlib, time

def verify(body: bytes, sig: str, ts: str, secret: str) -> bool:
    if abs(time.time() - int(ts)) > 300:      # 5 min
        return False
    expected = hmac.new(
        secret.encode(), ts.encode() + b"." + body,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, sig)

Delivery guarantees

At-least-once

We retry until you return 2xx, so the same event may arrive twice. Deduplicate on id. Retries back off exponentially for up to 24 hours.

Ordered per workspace

A sequence field increases monotonically. Receiving 48213 after 48215 means it is a late retry and can be discarded.

Disabled after 48h

An endpoint failing continuously for two days is switched off and the workspace admin is emailed. Ten second timeout per attempt.

Product

Solutions

Developers

Resources

Know the moment something changes.