Client webhooks

Configure HTTPS endpoints under Profile → Integrations → Webhooks. Deliveries are POST with JSON and are not listed as paths in this OpenAPI file.

Signature

Header: Fastorama-Signature: t=<unix_seconds>,v1=<hex>. Compute HMAC-SHA256 over t + "." + raw_body with your signing secret. Compare v1 to the digest as lowercase hex using a timing-safe compare. Reject if skew |now - t| > 300 seconds.

Use the raw request body — do not re-serialize JSON after parsing.

Headers

Fastorama-Event-Id, Fastorama-Event-Type, Fastorama-Delivery-Id, User-Agent: Fastorama-Webhooks/1.0, Content-Type: application/json

Product documentation

Topics, envelope, and operations: Client webhooks (signed-in docs).