Webhooks API endpoints

Webhooks let ErynoaGroup notify your application in real time when events occur. Use these endpoints to manage your webhook subscriptions programmatically, or configure them through your dashboard.

Webhook object

{
  "id": "wh_01HX4K9Z2QBZJMFR5T6VWYP8D",
  "url": "https://your-app.com/webhook",
  "events": ["resource.created", "resource.updated"],
  "status": "active",
  "secret": "whsec_...",
  "created_at": "2024-01-15T10:30:00Z"
}

Event types

Event	Triggered when
`resource.created`	A new resource is created
`resource.updated`	A resource’s attributes are changed
`resource.deleted`	A resource is deleted
`resource.status_changed`	A resource’s status changes

List webhooks

GET /v1/webhooks

Example:

curl -X GET https://api.erynoa.group/v1/webhooks \
  -H "Authorization: Bearer YOUR_API_KEY"

Create a webhook

POST /v1/webhooks

string

required

The HTTPS URL that receives event payloads. Must be publicly accessible.

array

required

List of event types to subscribe to. Use ["*"] to subscribe to all events.

Example:

curl -X POST https://api.erynoa.group/v1/webhooks \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-app.com/webhook",
    "events": ["resource.created", "resource.updated"]
  }'

Response: 201 Created — includes a secret field (shown only once) for signature verification.

Delete a webhook

DELETE /v1/webhooks/{id}

Example:

curl -X DELETE https://api.erynoa.group/v1/webhooks/wh_01HX4K9Z2QBZJMFR5T6VWYP8D \
  -H "Authorization: Bearer YOUR_API_KEY"

Webhook payload structure

Every event payload follows this structure:

{
  "id": "evt_01HX9P3NXVQMJRFT8K2BWYC7E",
  "type": "resource.created",
  "created_at": "2024-01-15T11:00:00Z",
  "data": {
    "object": {
      "id": "res_01HX9P3NXVQMJRFT8K2BWYC7E",
      "type": "resource",
      "status": "active",
      "name": "My Resource",
      "created_at": "2024-01-15T11:00:00Z"
    }
  }
}

Verifying webhook signatures

ErynoaGroup signs each payload using HMAC-SHA256 with your webhook secret. The signature is in the X-Erynoa-Signature header.

import hmac
import hashlib

def verify_webhook_signature(raw_body: bytes, secret: str, signature: str) -> bool:
    expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

Always verify the signature before processing a webhook payload. Skipping verification opens your endpoint to spoofed events.

Overview

Endpoints

Webhooks API endpoints

Webhook object

Event types

List webhooks

Create a webhook

Delete a webhook

Webhook payload structure

Verifying webhook signatures

​Webhook object

​Event types

​List webhooks

​Create a webhook

​Delete a webhook

​Webhook payload structure

​Verifying webhook signatures

Webhook object

Event types

List webhooks

Create a webhook

Delete a webhook

Webhook payload structure

Verifying webhook signatures