Webhooks

Setting up an endpoint

Create endpoints under Settings, Webhooks, with the webhooks:manage scope for API use. Each endpoint has a secret that starts with whsec_ and is shown once.

Verifying a delivery

The Instica-Signature header has a timestamp t and one or more v1 values. Each is an HMAC-SHA256 of the timestamp, a dot and the raw body, keyed with your secret. Reject a delivery whose timestamp is more than 5 minutes old.

Failed deliveries are retried with growing delays for up to 3 days. Rotating a secret keeps the old one valid for 24 hours.

Events

The full event list is on the API, webhooks and MCP page.