Webhooks

Receive signed event notifications at your backend in real time. HMAC-SHA256 signatures, 3 retries with exponential backoff.

Endpoint

Where Veris should POST event payloads. HTTPS only.

Not configured

Veris signs every request with HMAC-SHA256. Verify the X-Veris-Signature header against your signing secret to confirm authenticity.

Subscribed events

Toggle which events you want delivered. Unticked events are skipped silently.

Signing secret

Use this to verify HMAC-SHA256 signatures on incoming webhook requests.

Current secret
whsec_•••••••••••••••• (hidden)

Rotating the secret invalidates the old one immediately. Update your verification code first.

Verify signatures in your backend

const crypto = require('crypto');

// Use the RAW request body (before JSON parsing)
function verifyVerisWebhook(rawBody, signatureHeader, secret) {
  const expected = crypto.createHmac('sha256', secret)
    .update(rawBody).digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected), Buffer.from(signatureHeader || ''));
}

// Express: app.post('/veris-webhook', express.raw({type:'application/json'}), (req,res)=>{
//   if (!verifyVerisWebhook(req.body, req.get('X-Veris-Signature'), process.env.VERIS_WEBHOOK_SECRET))
//     return res.status(401).end();
//   const event = JSON.parse(req.body); ... res.status(200).end(); });
import hashlib, hmac

# Use the RAW request body (bytes), before JSON parsing
def verify_veris_webhook(raw_body: bytes, signature_header: str, secret: str) -> bool:
    expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature_header or "")

# FastAPI/Flask: read request.get_data() / await request.body(),
# compare against the X-Veris-Signature header, then parse JSON.

Always return 2xx quickly and process asynchronously — Veris retries failed deliveries up to 3 times.

Recent deliveries

Last 20 events sent to your endpoint.

Time Event Status HTTP Latency
Loading deliveries…