Odexy × Webhooks

What it does

Every state-changing action in Odexy emits a domain event. The CRM emits crm.deal.won when a deal is closed. Recruitment emits recruitment.application.hired when a candidate signs. Payroll emits payroll.run.finalized when a cycle closes. The full event taxonomy is documented in the developer docs.

Outbound webhooks let your own services subscribe to any of these events. Odexy POSTs the event payload (plus a signed signature) to your endpoint when it fires. Your service does whatever — sync to your data warehouse, post to Slack, fire a custom workflow.

Setup steps

1. In Odexy → Settings → Webhooks → New.

2. Configure:

- Name: human-readable, e.g. "Slack ops notifications."

- Target URL: https://your-service.com/webhooks/helios.

- Event subscriptions: pick one or many — crm.deal.won, recruitment.application.hired, *.invoice.paid (wildcards supported per module).

- Signing secret: Odexy generates this. Store it on your side; you'll verify every payload's HMAC-SHA256 signature with it.

3. Verify the endpoint. Odexy sends a helios.webhook.ping event with a random nonce. Your endpoint should respond 200 + echo the nonce back. The console runs this on creation.

4. Once live, every matching event POSTs to your URL.

Payload format

{
  "id": "evt_2026-05-19T05-32-41-abcd1234",
  "type": "crm.deal.won",
  "orgId": "org_acme",
  "occurredAt": "2026-05-19T05:32:41.123Z",
  "actor": { "type": "user", "id": "usr_olivia" },
  "data": {
    "dealId": "deal_42",
    "companyId": "co_acme",
    "amount": "150000",
    "currency": "USD"
  }
}

The Odexy-Signature header is an HMAC-SHA256 of the raw body + a timestamp, signed with your webhook's secret. Verify it before processing — Odexy's docs include a 20-line verification snippet for any language.

Retry + delivery

• Retry on failure. Non-2xx responses retry with exponential backoff: 1s, 5s, 25s, 2min, 10min, 1h. After ~24 hours of attempts, the delivery is marked failed and surfaced in the SaaS console dashboard.
• At-least-once. Webhooks are at-least-once. Your endpoint should be idempotent against the event id.
• Audit. Every webhook delivery (success + retries) is logged with the response code, latency, and error.

Why this exists

The action layer is the canonical API surface. But not every integration is best done by calling Odexy — many are best done by reacting to Odexy. Webhooks are the reactive surface.

Real-world uses we see:

• Data warehouse: subscribe to * and sink everything to BigQuery / Snowflake.
• Notifications: subscribe to recruitment.offer.signed and POST to Slack.
• Custom workflows: subscribe to crm.deal.lost to trigger a re-engagement email.
• Compliance: subscribe to iam.permission.granted for SIEM forwarding.

Related

See MCP server for the call-side. See Odexy AI for the action-layer architecture.