​
Webhooks

IdCanopy sends real-time updates about customer journeys to your webhook endpoint. This page covers how delivery works (configuration, security, retries) and the payload schema you’ll receive.

​
Configure

  • Webhook URL — Your HTTPS endpoint that accepts POST.
  • Events — Choose which journey events you want (e.g., journey completed, fraud alert).
  • Secret — We sign each request body with a shared secret so you can verify integrity.

​
Endpoint requirements

  • TLS: 1.2+
  • HTTP: POST
  • Body: application/json (default) or text/plain when an encrypted payload is used
  • Timeout/Response: Return HTTP 2xx within 10 seconds

​
Delivery & retries

If we don’t receive 2xx (or your endpoint times out), we retry for ~24 hours:
  • Up to 6 additional attempts
  • Increasing backoff (≈10s, 100s, 1000s, 10000s)

​
Security

We add a Signature header containing an HMAC-SHA256 of the raw request body, keyed with your Webhook Secret.
User-Agent: signteq.io API.
Use a constant-time comparison to prevent timing attacks.

​
Verify (PHP example)

<?php
$raw = file_get_contents('php://input');
$signature = $_SERVER['HTTP_SIGNATURE'] ?? '';
$secret = 'YOUR_WEBHOOK_SECRET';

$expected = hash_hmac('sha256', $raw, $secret);

if (!hash_equals($expected, $signature)) {
  http_response_code(401);
  exit('invalid signature');
}

http_response_code(200);

​
Testing

  • Use webhook.site to inspect incoming requests.
  • Use ngrok (or similar) to forward callbacks to a local environment.

​
Example payload

​
Payload reference

Tips
  • Treat “transactionId” and “artifact” links as sensitive; avoid logging them on the client.
  • Consider adding your own idempotency handling on receipt to avoid double-processing retries.
  • If you consume payloads in multiple systems, keep a small payload changelog in this page to track field additions.