Webhooks

Every mutation is an event. Every event is subscribable.

Odexy emits a typed event for every state change — deal won, invoice paid, employee onboarded, ticket resolved, contract signed. Subscribe your endpoint, receive HMAC-signed callbacks, replay any missed run.

Read the webhook docs API reference →

What ships

Delivery you can actually trust in production.

Typed event catalogue. Every module publishes its event classes (`sales.invoice.issued`, `crm.deal.won`, `hrm.leave.approved`, ~200 total). Every event has a Zod payload schema; you know the exact shape ahead of time.
HMAC-SHA256 signatures. Every callback carries `X-Signature: sha256=<hmac>` computed with your endpoint's shared secret. Verify before parsing; reject unsigned or misauthenticated requests.
Timestamp-anchored replay protection. `X-Timestamp` header + a 5-minute skew tolerance means an attacker can't replay a captured payload against you.
Retry with exponential backoff. First retry at 1 minute, then 5, 25, 2h, 12h, 24h. Failures beyond that mark the subscription unhealthy + email the owner.
Per-event replay. The admin UI shows every delivered + failed callback per subscription. One-click replay any specific event; batch-replay a range if your endpoint was down for hours.
Filtering. Subscribe to a single event (`sales.invoice.paid`) or a whole module wildcard (`sales.*`). Additive server-side filters (only events for a specific tenant, only above a specific amount).
Delivery observability. Per-subscription dashboard: success rate, p50 / p95 latency, last-delivered timestamp, unhealthy alert threshold.

Sample payload

Deal-won callback.

POST https://your-endpoint.example.com/hooks/helios
X-Signature: sha256=abcd1234...
X-Timestamp: 1735689600
X-Event-Class: crm.deal.won
X-Event-Id: evt_01H...

{
  "id": "evt_01H...",
  "class": "crm.deal.won",
  "occurredAt": "2026-08-29T12:34:56.789Z",
  "orgId": "01H...",
  "actor": { "type": "user", "id": "01H..." },
  "payload": {
    "dealId": "01H...",
    "companyId": "01H...",
    "amountCents": 4800000,
    "currency": "USD",
    "wonAt": "2026-08-29T12:34:56.789Z"
  }
}

Verify: `hmac_sha256(secret, timestamp + '.' + body) === signature`, then check `abs(now - timestamp) < 300` seconds. If either fails, respond `401` — we retry until you fix it or manually disable the subscription.

Webhooks

Subscribe your endpoint.

Signed, retried, replayable. The same event stream the AI and audit log see.

HMAC-signed

SHA-256 signature per delivery in an `X-Helios-Signature` header. Verify with your endpoint secret; rotate any time.

Retried with backoff

Five attempts with exponential backoff up to 24 hours. 5xx and network errors retry; 4xx surface immediately.

Replayable

Every delivery — the request headers, body, timing, response — is inspectable in the admin console and retriggerable in one click.

Read the webhook docs API reference