Realtime

Webhooks

Receive signed events, inspect delivery attempts, replay failed deliveries, and requeue dead-lettered events.

Horato emits domain events after provider sync, API writes, approvals, booking lifecycle changes, and operational jobs.

Signature verification

Verify the timestamp and signature before processing an event. Reject stale timestamps to reduce replay risk.

Node verification sketchjavascript
import { verifyHoratoWebhook } from "@horato/unified";

const verified = verifyHoratoWebhook({
  rawBody,
  signature: req.headers["horato-signature"],
  secret: process.env.HORATO_WEBHOOK_SECRET
});

Delivery repair

Use the delivery inspector when a receiver returns a non-2xx status. Fix the receiver, replay the delivery, then clear dead-letter queues intentionally.

  • List deliveries with `/v1/webhooks/deliveries`.
  • Replay one delivery with `/v1/webhooks/deliveries/{delivery_id}/replay`.
  • Requeue dead-lettered events with `/v1/webhooks/dead-letter/{event_id}/requeue`.