Receive an outbound webhook event
Guest Machines sends this signed request to the HTTPS destination configured in the console. Verify the signature against the exact raw body before parsing JSON.
The signed bytes are timestamp + "." + raw_body, using the Unix-seconds X-GuestMachines-Timestamp header and the signing secret shown once at webhook creation or rotation. Select the sha256 element from the comma-separated signature header and compare its lowercase hexadecimal HMAC-SHA256 value in constant time. Reject stale timestamps according to your own clock-skew tolerance.
Delivery is at least once. Any 2xx response succeeds; a network failure, timeout, redirect, or non-2xx response is retried up to 5 total attempts with exponential backoff starting at 30 seconds. Ordering across different events is not guaranteed. Store the delivery ID before starting side effects and return quickly.
The body is capped at 64 KiB. Event data is a bounded public projection, not an execution transcript or result transport. Ignore fields and event types you do not recognize.
Header Parameters
Comma-separated scheme=value elements. Select sha256; ignore unknown additive schemes.
Unix seconds included in the signed message.
^[0-9]+$Matches the body event value.
Matches the body delivery_id and remains unchanged across retries.
^[1-9][0-9]*$Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
The signed JSON body delivered to a subscriber. The delivery ID is stable across every retry of this logical delivery.
Response Body
Example Requests
The signed JSON body delivered to a subscriber. The delivery ID is stable across every retry of this logical delivery.
/outboundEvent