Webhooks and event recovery

Configure a destination

An administrator expands an API key in API & integrations and adds an HTTP or HTTPS destination. HTTPS is recommended; the interface warns about HTTP, direct IP addresses and local addresses without preventing registration. The middleware must be able to reach the URL for delivery to work. A destination belongs to that key and has its own signing secret, displayed only when it is created or rotated. Select event types if the receiver needs only part of the feed. Rotating or revoking a key also affects its destinations; keep a receiver ready before enabling delivery.

Verify before processing

Every delivery contains webhook-id, webhook-timestamp and webhook-signature. The signature uses Standard Webhooks: HMAC-SHA256 over the UTF-8 bytes of webhook-id + "." + webhook-timestamp + ".", followed by the exact raw body bytes. The secret has a whsec_ prefix and a Base64-encoded signing key. Compare the Base64 signature from a v1, entry using a constant-time comparison.

Reject timestamps more than five minutes away from your server time. Verify the signature before parsing the JSON body. Check that the event body’s id equals webhook-id, then store that ID before applying business effects. A quick successful 2xx response acknowledges the delivery.

Deliveries are at least once and may arrive out of order. Deduplicate by event ID. A completed event contains identifiers and API paths; fetch the current report or dossier through the authenticated API when you need the full data. The completion events are rental.departure.completed and rental.return.completed. Corrections and PDF readiness have separate events. See the Rental OpenAPI webhook definition for every event type and field.

Recover missed events

Use GET /v1/events with its cursor and optional created_after filter to reconcile after downtime. Events remain available for 30 days. Advance your stored cursor only after processing the returned page. If your receiver was unavailable, the platform retries failed webhook deliveries up to eight times over 48 hours; an administrator can inspect and retry recent failures from API & integrations.

Treat the event feed as a notification and the authenticated resource routes as the source for current data. Report identities and versions explain how to archive results safely.