# Webhooks

> Receive signed HTTPS callbacks when servers change state, invoices are issued or attacks start.

Source: https://docs.avenlith.com/en/webhooks  
Category: API & automation  
Last updated: 2026-09-22

## Events

| Event | Sent when |
| --- | --- |
| `server.created`, `server.deleted` | A server is provisioned or removed |
| `server.status_changed` | Running, stopped, rescue |
| `invoice.issued`, `invoice.paid` | Billing events |
| `attack.started`, `attack.ended` | Shield mitigations |
| `backup.failed` | A scheduled backup did not complete |

## Verify signatures

Every request carries `X-Avenlith-Signature`, an HMAC-SHA256 of the raw body using your endpoint secret:

```js
import crypto from 'node:crypto'

export function verify(rawBody, signature, secret) {
  const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex')
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature))
}
```

## Delivery

Your endpoint must answer with a 2xx status within 10 seconds. Failed deliveries are retried with exponential backoff for 24 hours; after that the endpoint is disabled and the project owner is notified.

> **Tip:** > Events can arrive more than once. Use the `event_id` field to ignore duplicates.