> ## Documentation Index
> Fetch the complete documentation index at: https://docs.erynoa.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhooks API endpoints

> API reference for ErynoaGroup webhook management. Create, list, update, and delete webhook subscriptions. Review event types and payload schemas.

Webhooks let ErynoaGroup notify your application in real time when events occur. Use these endpoints to manage your webhook subscriptions programmatically, or configure them through your dashboard.

## Webhook object

```json theme={null}
{
  "id": "wh_01HX4K9Z2QBZJMFR5T6VWYP8D",
  "url": "https://your-app.com/webhook",
  "events": ["resource.created", "resource.updated"],
  "status": "active",
  "secret": "whsec_...",
  "created_at": "2024-01-15T10:30:00Z"
}
```

## Event types

| Event                     | Triggered when                      |
| ------------------------- | ----------------------------------- |
| `resource.created`        | A new resource is created           |
| `resource.updated`        | A resource's attributes are changed |
| `resource.deleted`        | A resource is deleted               |
| `resource.status_changed` | A resource's status changes         |

## List webhooks

```
GET /v1/webhooks
```

**Example:**

```bash theme={null}
curl -X GET https://api.erynoa.group/v1/webhooks \
  -H "Authorization: Bearer YOUR_API_KEY"
```

## Create a webhook

```
POST /v1/webhooks
```

<ParamField body="url" type="string" required>
  The HTTPS URL that receives event payloads. Must be publicly accessible.
</ParamField>

<ParamField body="events" type="array" required>
  List of event types to subscribe to. Use `["*"]` to subscribe to all events.
</ParamField>

**Example:**

```bash theme={null}
curl -X POST https://api.erynoa.group/v1/webhooks \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-app.com/webhook",
    "events": ["resource.created", "resource.updated"]
  }'
```

**Response:** `201 Created` — includes a `secret` field (shown only once) for signature verification.

## Delete a webhook

```
DELETE /v1/webhooks/{id}
```

**Example:**

```bash theme={null}
curl -X DELETE https://api.erynoa.group/v1/webhooks/wh_01HX4K9Z2QBZJMFR5T6VWYP8D \
  -H "Authorization: Bearer YOUR_API_KEY"
```

## Webhook payload structure

Every event payload follows this structure:

```json theme={null}
{
  "id": "evt_01HX9P3NXVQMJRFT8K2BWYC7E",
  "type": "resource.created",
  "created_at": "2024-01-15T11:00:00Z",
  "data": {
    "object": {
      "id": "res_01HX9P3NXVQMJRFT8K2BWYC7E",
      "type": "resource",
      "status": "active",
      "name": "My Resource",
      "created_at": "2024-01-15T11:00:00Z"
    }
  }
}
```

## Verifying webhook signatures

ErynoaGroup signs each payload using HMAC-SHA256 with your webhook secret. The signature is in the `X-Erynoa-Signature` header.

```python theme={null}
import hmac
import hashlib

def verify_webhook_signature(raw_body: bytes, secret: str, signature: str) -> bool:
    expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)
```

<Warning>
  Always verify the signature before processing a webhook payload. Skipping verification opens your endpoint to spoofed events.
</Warning>