Skip to main content
POST
Create webhook subscription
Subscribe to real-time events from Aura. How it works:
  1. Create a subscription with your endpoint URL
  2. Store the secret from this response — it is returned only here, never by GET /v1/webhooks or GET /v1/webhooks/{id}. If you lose it, rotate it with POST /v1/webhooks/{id}/rotate-secret.
  3. When events occur, Aura sends HTTP POST requests to your URL
  4. Verify requests using the X-Aura-Signature header
Security:
  • Target URL must use HTTPS (no HTTP allowed)
  • Each webhook is signed with HMAC-SHA256
  • Use the secret to verify request authenticity
Payload Format:
Signature Verification:
Retry Policy:
  • Failed deliveries are retried 3 times
  • Backoff: 1s, 5s, 15s
  • Subscriptions with repeated failures may be disabled
Exactly-once processing (idempotency_key):
  • Every envelope carries an idempotency_key that is stable across retries of the same event. If your endpoint commits its side effect then crashes before returning 2xx, the redelivery carries the same key.
  • Enforce exactly-once by adding a (subscription_id, idempotency_key) unique constraint on your side and dropping the row on conflict.
  • The key is inside the signed body, so the HMAC signature covers it.

Body

application/json
event_type
enum<string>
required

Event type to subscribe to

Available options:
lead.created,
lead.updated,
lead.status_changed,
call.booked,
call.updated,
call.started,
call.completed,
call.canceled,
call.rescheduled,
call.closer_reassigned,
call.no_show,
call.analysis_completed,
payment.succeeded,
payment.failed,
payment.refunded
Example:

"call.booked"

target_url
string<uri>
required

HTTPS URL where webhook payloads will be sent (must be publicly accessible)

Example:

"https://api.example.com/webhooks/aura"

Response

Webhook subscription created successfully

data
object
required
success
enum<boolean>
required
Available options:
true