Webhooks
Receive signed HTTPS callbacks when servers change state, invoices are issued or attacks start.
On this page
Events#
| Event | Sent when |
|---|---|
server.created, server.deleted | A server is provisioned or removed |
server.status_changed | Running, stopped, rescue |
invoice.issued, invoice.paid | Billing events |
attack.started, attack.ended | Shield mitigations |
backup.failed | A scheduled backup did not complete |
Verify signatures#
Every request carries X-Avenlith-Signature, an HMAC-SHA256 of the raw body using your endpoint secret:
JavaScript
import crypto from 'node:crypto'
export function verify(rawBody, signature, secret) {
const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex')
return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature))
}
Delivery#
Your endpoint must answer with a 2xx status within 10 seconds. Failed deliveries are retried with exponential backoff for 24 hours; after that the endpoint is disabled and the project owner is notified.
Was this page helpful?
Still need help?
Our engineers answer tickets 24/7 — average first response in 7 minutes.