Webhooks

Webhooks let AOH Sync push real-time event notifications to your own infrastructure. When something changes in your tenant — a sync completes, an identity is modified — AOH Sync sends an HTTP POST to your configured endpoint.

Subscription model

A webhook subscription consists of:

Field	Type	Description
id	string	Unique identifier for the subscription
callback_url	URI	The HTTPS endpoint AOH Sync sends events to
events	string[]	Event types this subscription listens for (at least one)
active	boolean	Whether the subscription is currently delivering events
created_at	datetime	When the subscription was created

When you create a subscription, the response also includes a one-time signing_secret. Store this immediately — it is never returned again.

Create a subscription

POST /v1/webhooks
X-API-Key: your-api-key-here
Content-Type: application/json

{
  "callback_url": "https://your-server.example.com/cloudsync/events",
  "events": ["sync.completed", "identity.updated"]
}

Response (201 Created):

{
  "id": "wh_01abc",
  "callback_url": "https://your-server.example.com/cloudsync/events",
  "events": ["sync.completed", "identity.updated"],
  "active": true,
  "created_at": "2025-07-21T10:00:00Z",
  "signing_secret": "whsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

The signing_secret is returned only once, at creation time. If you lose it, rotate the secret using the /v1/webhooks/{id}/rotate-secret endpoint.

List subscriptions

GET /v1/webhooks
X-API-Key: your-api-key-here

Response (200 OK):

{
  "data": [
    {
      "id": "wh_01abc",
      "callback_url": "https://your-server.example.com/cloudsync/events",
      "events": ["sync.completed", "identity.updated"],
      "active": true,
      "created_at": "2025-07-21T10:00:00Z"
    }
  ],
  "total": 1
}

The signing_secret is not included in list or update responses — only in the create and rotate-secret responses.

Update a subscription

Use PATCH /v1/webhooks/{id} to change the callback URL, event list, or active state. All fields are optional; only the ones you send are updated.

PATCH /v1/webhooks/wh_01abc
X-API-Key: your-api-key-here
Content-Type: application/json

{
  "active": false
}

Response (200 OK): Returns the updated Webhook object (without signing_secret).

To re-enable a paused subscription, send "active": true.

Delete a subscription

DELETE /v1/webhooks/wh_01abc
X-API-Key: your-api-key-here

Response: 204 No Content. The subscription is removed and AOH Sync stops delivering events to that endpoint.

Signing secret & verification

Every event delivery is signed with HMAC-SHA256 using your subscription's signing_secret. Verify the signature on every incoming request to confirm it came from AOH Sync and was not tampered with.

Secret rotation

If your signing secret is compromised, rotate it without deleting and recreating the subscription:

POST /v1/webhooks/wh_01abc/rotate-secret
X-API-Key: your-api-key-here

Response (200 OK):

{
  "signing_secret": "whsec_yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy"
}

The new signing_secret is returned only once. Update your verification logic immediately — the old secret stops working as soon as the new one is issued.

Event delivery

AOH Sync sends a POST request to your callback_url for each event the subscription is configured to receive. Your endpoint must return a 2xx status code to acknowledge receipt.

Related

• API Overview & Authentication
• Public API Reference
• Errors & Rate Limits