> For the complete documentation index, see [llms.txt](https://docs.aohwv.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aohwv.dev/developer-and-api/webhooks.md).

# Webhooks

Webhooks let AOH Sync push real-time event notifications to your own infrastructure. When something changes in your tenant — a sync completes, an identity is modified — AOH Sync sends an HTTP POST to your configured endpoint.

## Subscription model

A webhook subscription consists of:

| Field          | Type      | Description                                              |
| -------------- | --------- | -------------------------------------------------------- |
| `id`           | string    | Unique identifier for the subscription                   |
| `callback_url` | URI       | The HTTPS endpoint AOH Sync sends events to              |
| `events`       | string\[] | Event types this subscription listens for (at least one) |
| `active`       | boolean   | Whether the subscription is currently delivering events  |
| `created_at`   | datetime  | When the subscription was created                        |

When you create a subscription, the response also includes a one-time `signing_secret`. Store this immediately — it is never returned again.

## Create a subscription

```http
POST /v1/webhooks
X-API-Key: your-api-key-here
Content-Type: application/json

{
  "callback_url": "https://your-server.example.com/cloudsync/events",
  "events": ["sync.completed", "identity.updated"]
}
```

**Response (201 Created):**

```json
{
  "id": "wh_01abc",
  "callback_url": "https://your-server.example.com/cloudsync/events",
  "events": ["sync.completed", "identity.updated"],
  "active": true,
  "created_at": "2025-07-21T10:00:00Z",
  "signing_secret": "whsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
```

{% hint style="warning" %}
The `signing_secret` is returned only once, at creation time. If you lose it, rotate the secret using the `/v1/webhooks/{id}/rotate-secret` endpoint.
{% endhint %}

## List subscriptions

```http
GET /v1/webhooks
X-API-Key: your-api-key-here
```

**Response (200 OK):**

```json
{
  "data": [
    {
      "id": "wh_01abc",
      "callback_url": "https://your-server.example.com/cloudsync/events",
      "events": ["sync.completed", "identity.updated"],
      "active": true,
      "created_at": "2025-07-21T10:00:00Z"
    }
  ],
  "total": 1
}
```

The `signing_secret` is not included in list or update responses — only in the create and rotate-secret responses.

## Update a subscription

Use `PATCH /v1/webhooks/{id}` to change the callback URL, event list, or active state. All fields are optional; only the ones you send are updated.

```http
PATCH /v1/webhooks/wh_01abc
X-API-Key: your-api-key-here
Content-Type: application/json

{
  "active": false
}
```

**Response (200 OK):** Returns the updated `Webhook` object (without `signing_secret`).

To re-enable a paused subscription, send `"active": true`.

## Delete a subscription

```http
DELETE /v1/webhooks/wh_01abc
X-API-Key: your-api-key-here
```

**Response:** `204 No Content`. The subscription is removed and AOH Sync stops delivering events to that endpoint.

## Signing secret & verification

Every event delivery is signed with HMAC-SHA256 using your subscription's `signing_secret`. Verify the signature on every incoming request to confirm it came from AOH Sync and was not tampered with.

## Secret rotation

If your signing secret is compromised, rotate it without deleting and recreating the subscription:

```http
POST /v1/webhooks/wh_01abc/rotate-secret
X-API-Key: your-api-key-here
```

**Response (200 OK):**

```json
{
  "signing_secret": "whsec_yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy"
}
```

{% hint style="warning" %}
The new `signing_secret` is returned only once. Update your verification logic immediately — the old secret stops working as soon as the new one is issued.
{% endhint %}

## Event delivery

AOH Sync sends a `POST` request to your `callback_url` for each event the subscription is configured to receive. Your endpoint must return a `2xx` status code to acknowledge receipt.

## Related

* [API Overview & Authentication](/developer-and-api/developer-api.md)
* [Public API Reference](/developer-and-api/reference.md)
* [Errors & Rate Limits](/developer-and-api/errors-and-rate-limits.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.aohwv.dev/developer-and-api/webhooks.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.