Skip to main content
WEBHOOK

Headers

X-Webhook-Signature
string
required

Base64-encoded HMAC-SHA256 signature of the raw request body, computed with the subscription's secret. See Webhook security.

X-Event-Id
string
required

Unique identifier of the event. Equals the envelope's id field.

X-Event-Type
string
required

CloudEvent type string of the event. Equals the envelope's type field.

Body

application/json

CloudEvents v1.0 envelope wrapping every webhook delivery. FuelBoss sends the envelope as the JSON request body of a POST to the subscribed URL.

specversion
string

CloudEvents specification version. Always 1.0.

id
string

Unique identifier of this event (UUID). Use it for idempotency checking: retries of the same event carry the same identifier.

type
string

Event type in CloudEvents reverse-domain format (for example net.fuelboss.nomination.created). Note this differs from the value used when subscribing (for example nomination_created).

source
string

URN identifying the source of the event (for example urn:fuelboss:nominations:NOM-2025-001).

time
string<date-time>

When the event occurred, as an RFC 3339 timestamp in UTC.

datacontenttype
string

Content type of the data field. Always application/json.

data
object

Event-specific payload.

Response

2XX

Respond with any 2xx status within 10 seconds to acknowledge the delivery. Any other response, or a timeout, triggers retries with exponential backoff.