Webhooks

Webhooks deliver events to a URL you control. Register endpoints in the dashboard

or via `POST /webhooks`.

Verifying signatures

Each delivery includes an `X-Orbit-Signature` header: an HMAC-SHA256 of the raw

body using your signing secret. Compare it to a locally computed HMAC before

trusting the payload.

Timeouts and retries

Respond with a `2xx` within 5 seconds. Non-2xx or a timeout triggers retries with

exponential backoff for up to 24 hours.

Rules for agents

• Verify the signature before acting on any webhook payload.
• Respond 2xx immediately, then process asynchronously; do not block the response.