Skip to main content
Webhooks aren’t served by the real API yet — only by the local mock. See the availability note at the top of the API Reference.

​
Events

Three events exist in v1:

​
Subscribing

POST /webhooks with a url (HTTPS required) and the events you want. The response includes a secret — shown once, at creation. Store it: it’s what you use to verify every delivery to this subscription.

​
The delivery

Every event is delivered as a POST to your subscribed URL, with this envelope:
data’s shape depends on type — a Lead for lead.created, a Run for run.completed, an Automation for automation.status_changed. id is unique per event, not per delivery attempt. Use it to deduplicate — the same event can be redelivered after a retry.

​
Verifying the signature

Every delivery carries an X-Agentova-Signature header:
  • t — a Unix timestamp
  • v1 — an HMAC-SHA256 hex digest, computed over the string {t}.{raw request body}, using your subscription’s secret
To verify a delivery:
  1. Reject it if t is more than 5 minutes from the current time — this stops replay attacks.
  2. Recompute the HMAC over {t}.{raw body} with your secret.
  3. Compare it to v1 using a constant-time comparison — never a plain ===, which leaks timing information.
Official Agentova connectors (the n8n node and the Zapier app) verify this for you automatically — you don’t need to do anything extra if you’re using one of them. This section is for a direct HTTP integration.

​
Reliability

Agentova expects a 2xx response within 10 seconds. A failing or slow endpoint gets retried with exponential backoff. After prolonged failures, the subscription is disabled — there’s no dedicated event for this, check disabled_at on GET /webhooks.