Webhooks

Real-time events to your systems — signed and retryable.

Webhooks notify your system in real time about events in Astreo — e.g. when a new message arrives or a thread is assigned. This lets you build automations without constant polling.

Setup

Create a webhook subscription in the settings:

• Target URL: a publicly reachable HTTPS endpoint of your system.
• Events: choose the types you want to receive.
• Secret: used for signature verification (see below) — keep it safe.

Event types

Astreo sends events around the inbox and collaboration (e.g. new message, thread assigned, status changed). The exact available types are shown when you create the subscription. Each delivery is a JSON payload with the event type and the affected object IDs.

Signature verification (HMAC)

Every delivery is HMAC-signed with your secret and carries the signature in an HTTP header. Verify it on receipt before processing the payload, to ensure authenticity:

// Node.js (example)
const crypto = require('crypto');
const expected = crypto.createHmac('sha256', SECRET)
  .update(rawBody)            // use the RAW request body
  .digest('hex');
// compare expected to the header signature in constant time

Use the unmodified raw body text — not the parsed JSON.

Delivery & retries

• Respond with 2xx once you've accepted the event (ideally fast, processing asynchronously).
• On errors or timeouts, Astreo retries delivery with backoff.
• Make your endpoint idempotent — the same event may arrive more than once.