Webhooks
Events
| Event | Trigger |
|---|---|
go.click | Short link clicked |
note.shared | Note made public |
auth.suspicious_login | Login from new device fingerprint |
Subscribe
POST /api/webhooks
{
"url": "https://your-app.com/webhooks/auva",
"events": ["go.click", "note.shared"]
}
Store the returned secret - it is only shown once.
Verification
Each delivery includes:
Auva-Signature: <hmac-sha256-hex>
Auva-Event: go.click
Verify by HMAC-SHA256 of the raw JSON body with your secret.
Processing
Failed deliveries retry with exponential backoff (max 5 attempts). Trigger processing:
POST /api/internal/webhooks/process
X-Cron-Secret: YOUR_INTERNAL_CRON_SECRET