← All integrations
Developer · via Signed HTTP callback
Veriastra in Webhooks
A bulk job of any size finishes when it finishes. Rather than polling, give us a URL and we deliver the results to it, signed, so your endpoint can prove the delivery came from us and was not modified on the way.
01
Send a webhook URL with the job
Any bulk job accepts one.
curl -X POST https://veriastra.com/api/bulk \
-H "Authorization: Bearer ol_live_your_key_here" \
-H "Content-Type: application/json" \
-d '{"type":"phone","items":["+14155552671"],"webhook":"https://yourapp.com/hooks/veriastra"}'02
Read your signing secret
GET /api/account returns webhookSecret for the calling key.
curl -H "Authorization: Bearer ol_live_your_key_here" https://veriastra.com/api/account03
Verify every delivery
The signature header carries a timestamp and an HMAC over timestamp.body. Compare with a constant-time check, and reject anything whose timestamp is outside a few minutes — that is what stops a captured delivery being replayed at you later.
const [t, sig] = header.split(',').map(p => p.split('=')[1]);
const expected = crypto.createHmac('sha256', secret)
.update(t + '.' + rawBody).digest('hex');
const ok = crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))
&& Math.abs(Date.now() / 1000 - Number(t)) < 300;Before you rely on it
- Verify against the RAW body. Parsing and re-serialising JSON changes bytes and the signature will not match — this is the single most common reason a correct secret still fails.
- Deliveries retry on failure. Make your handler idempotent on `jobId`.