Receive a webhook
Implement this POST handler on your own HTTPS server to receive signed change notifications from ProBB AI. This is your receiver, not a ProBB AI API URL.
Before you call
Configure an endpoint in Settings → Developer and store its signing secret. Read raw bytes and verify webhook-id, webhook-timestamp, and webhook-signature before parsing JSON.
What happens next
Durably record the event ID and processing intent, then respond promptly with any 2xx. Fetch the current resource with your API key when your background handler processes the event.
Recovery
Events may arrive more than once or out of order. Deduplicate by verified event ID; verify a five-minute timestamp tolerance. Retryable delivery failures receive up to seven HTTP attempts. See the recovery guide for replay and catch-up.
Follow the complete workflow · Errors and retries
webhook-id*stringSigned event UUID. Must match the envelope id after signature verification.
webhook-timestamp*stringUnix timestamp in seconds, refreshed for each delivery; enforce a five-minute tolerance.
webhook-signature*stringOne or more v1 HMAC signatures. Verify against the raw request body with your receiver's signing secret.
application/json- body
id*stringResource identifier. External-reference IDs are supplied by your system; resource/event IDs are returned by ProBB AI.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$uuidschemaVersion*numberPublic payload format version. Result requests currently support 1; this is independent of the assigned product version.
occurredAt*stringUTC time the event occurred. Delivery may be delayed or out of order.
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$date-timetype*stringEvent type. Subscribe to the events needed for your workflow and process unknown future types safely.
data*Public resource or event payload. Successful API responses wrap their result in data; webhook envelopes contain event-specific data.
Return any 2xx after durably recording the event; no response body is required.
Example Requests
/reportEvent