Receive events with webhooks

Allpage POSTs each event as JSON to your https address, signed per Standard Webhooks. Every event and its payload is listed at https://allpage.site/docs/webhooks.

Add an address

• The owner: under Settings, For developers, add the address and pick events. Picking none sends the standard ones.
• Your app: with a token that may get events, call webhooks.subscribe with {"url": "https://example.com/hooks/allpage", "events": ["offering.enrolled"]} over the API. Keep the id and secret it returns. webhooks.unsubscribe with that id stops it. An app only gets events about what it can already see.

Check the signature

Each POST has webhook-id, webhook-timestamp and webhook-signature headers. The signature is v1,<base64 HMAC-SHA256 of "<webhook-id>.<webhook-timestamp>.<body>"> with your whsec_ secret. Use any Standard Webhooks library. While the owner rotates the secret, two signatures come for a day.

Answer fast

Answer with any 2xx. Anything else is retried with backoff. id stays the same on every retry and replay, so use it to drop repeats. The owner can send any delivery again from the delivery log.

Versions

Each address is pinned to the API version that was newest when it was added. Every body names it in apiVersion, and its data keeps that version's shape. An address that picks no events gets only the standard events its version has, so an event added later doesn't arrive unannounced. Pick a newer event by name to get it.

Each event's payload also has a version, listed in the reference. A change to an event's data bumps it.

A replay sends the stored body again, unchanged.