Receive an event

webhook

djfindrEvent

What DJfindr sends to the URL an app registered (PUT /app/webhook): every /me/updates item of each person who has connected the app, while their grant lasts and only for the event types their grant's scopes cover, filtered by the webhook's event_types; a link's events go only to the app that made the link. Answer 2xx within 10 seconds; redirects are not followed. A failed delivery is retried after 1 m, 5 m, 30 m, 2 h, 6 h, 12 h and 24 h (8 attempts), then failed.

Payload

The /me/updates item, plus delivery_id, api_version and user_id (whose token to use to read the thing it is about). It says what changed, never the details: data holds ids, statuses, kinds and amounts (minor units) only. Read the record itself with that person's token.

string

required

aev_...: the event; the same in /me/updates and on every delivery.

delivery_id

string

required

whd_..., as the DJfindr-Webhook-Id header.

type

string

required

The event type, such as booking.confirmed or payment.paid (the catalogue is on the Updates page), or webhook.test. Ignore a type you do not know: new ones are added.

created_at

date-time

required

seq

integer

required

The event's place in the feed (increasing, never reused).

api_version

string

required

user_id

string | null

required

The person (usr_...); null for webhook.test.

role

string | null

required

Their side: client, dj, payer, participant or owner; null for webhook.test.

subject

object

required

proposal_id

string | null

required

payment_id

string | null

required

conversation_id

string | null

required

data

object

required

Headers

User-Agent

string

required

DJfindr-Webhooks/1.

DJfindr-Webhook-Id

string

required

The delivery (whd_...), the same on every retry: dedupe on it.

DJfindr-Event-Id

string

required

The event (aev_...).

DJfindr-Webhook-Timestamp

string

required

Unix seconds of this attempt. Reject one older than 5 minutes.

DJfindr-Signature

string

required

v1=<hex>, one per valid secret, comma-separated (two for 24 hours after a rotation): hex(HMAC-SHA256(secret, timestamp + "." + raw_body)). Compare in constant time against each.

Response

2XX

Received. Anything else, or no answer within 10 seconds, is retried.

Loading…