← Nautilinks Developers

Webhooks

Nautilinks signed webhooks

Receive order lifecycle changes without polling. Endpoints, event names, payloads and errors are typed in the public OpenAPI document.

Subscribe

Call POST /api/v1/agent/webhooks with a public HTTPS URL and one or more supported events: order.accepted, order.published, or order.cancelled. Private, loopback, unresolved, redirecting, and non-HTTPS targets are refused.

curl --fail-with-body -X POST \
  -H "Authorization: Bearer $NAUTILINKS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com/hooks/nautilinks","events":["order.published"]}' \
  https://nautilinks.co/api/v1/agent/webhooks

Verify every delivery

The creation response reveals secret once and identifies its derivation as hex(sha256(secret)). Derive that ASCII hexadecimal value as the HMAC key. Then verify v1 from Nautilinks-Signature: t=<unix>,v1=<hex> against HMAC-SHA256 of <t>.<raw JSON body>. Reject stale timestamps and compare signatures in constant time.

The Nautilinks-Event header repeats the event name. Parse the body only after verifying its raw bytes, return a 2xx quickly, and make downstream processing idempotent.

Inspect or revoke

GET /api/v1/agent/webhooks lists subscriptions and recent delivery state. DELETE /api/v1/agent/webhooks/{webhookId} soft-revokes an owned subscription. See the Nautilinks OpenAPI specification for request and response schemas.