Webhooks

Configuring one

Webhooks are configured in the dashboard, not through the API — there is no /v1/webhooks route. Set the URL and its signing secret at /profile/integrations. The secret is stored server-side and never reaches a browser. One endpoint covers every event on the account.

• Must be https. Plain http is refused.
• Must resolve to a public host — loopback, link-local and RFC1918 literals are refused, because we POST to this from our own servers.
• Redirects are not followed. A 302 is the standard way to walk a validated public URL round to an internal one.

Events

Today there is one: registration.confirmed, fired the moment a booking is confirmed and its ticket issued.

{
  "type":      "registration.confirmed",
  "createdAt": "2027-09-01T10:04:11.760Z",
  "data": {
    "registrationId": "…",  "eventId":    "…",   "eventTitle": "…",
    "name":           "…",  "email":      "…",   "phone":      "…",
    "ticketType":     "…",  "subEventId": "…",   "quantity":   1,
    "amountPaid":     0,    "currency":   "INR", "paymentStatus": "…"
  }
}

Verifying the signature

We sign the exact bytes we send. Recompute the HMAC over the raw body and compare in constant time.

// Headers we send:
//   X-Vihaya-Signature: sha256=<hex>     <-- note the prefix
//   X-Vihaya-Timestamp: <unix milliseconds>

const timestamp = req.headers['x-vihaya-timestamp'];
const header    = req.headers['x-vihaya-signature'];

// The signature is prefixed. Strip it before comparing, or the two buffers
// are different lengths and timingSafeEqual throws.
const signature = String(header).replace(/^sha256=/, '');

const expected = crypto
  .createHmac('sha256', WEBHOOK_SECRET)
  .update(`${timestamp}.${rawBody}`)   // raw body, before JSON.parse
  .digest('hex');

if (signature.length !== expected.length ||
    !crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature))) {
  return res.status(401).end();
}

// Reject an old timestamp too — that is what makes a captured
// delivery non-replayable.
if (Date.now() - Number(timestamp) > 5 * 60 * 1000) return res.status(401).end();

Delivery behaviour

• The timestamp is inside the signed payload, so a captured delivery cannot be replayed.
• We wait at most 5 seconds for your endpoint and never retry into a hanging server.
• A failing webhook never blocks a registration. The attendee still gets their ticket.
• Nothing is retried. One attempt per event, so a delivery you drop is gone.
• Ordering is not guaranteed. Use createdAt if it matters.
• Your response body is never read. Returning data to us achieves nothing.

What to do with it

The most common use is issuing your own ticket — data.registrationId is the QR payload, so you can render the code and send the email entirely from your own system. See Tickets & QR codes.