Webhook & Integration Event Reference

Everything you need to build reliable listeners for Kontraktr™ events, debug sync failures, and understand exactly what data flows between Kontraktr™ and your connected tools — Stripe, Twilio, QuickBooks, EasyPost, Zapier, and Make.com.

15 min read Updated March 2026 Live event payloads

Outbound Webhooks

Kontraktr™ sends these events to your registered endpoints whenever things happen in your shop. Set up endpoints in Settings → Integrations → Webhooks.

Signature Verification

Every outbound request includes an X-Webhook-Signatureheader. Verify it to confirm the request is genuinely from Kontraktr™ and hasn't been tampered with.

typescript

import { createHmac, timingSafeEqual } from "crypto";

function verifyKontraktrSignature(
  rawBody: string,
  secret: string,
  signatureHeader: string // e.g. "sha256=abc123..."
): boolean {
  const expected = "sha256=" + createHmac("sha256", secret)
    .update(rawBody, "utf8")
    .digest("hex");

  // Timing-safe comparison prevents timing attacks
  return timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signatureHeader)
  );
}

Always use the raw request body (before JSON parsing) for signature verification. Parsed and re-serialized JSON may not match byte-for-byte.

Compatibility headers sent on every request

Header	Value
X-Webhook-Signature	sha256={hex digest}
X-Webhook-Delivery	{deliveryId}
X-Zapier-Event	{event name} (for Zapier endpoints)
X-Hook-Event	{event name} (for Make.com endpoints)
User-Agent	Kontraktr™-Webhooks/1.0
Content-Type	application/json

Payload Envelope

Every outbound webhook wraps its event-specific data in a consistent envelope.

json

{
  "event": "job.status_changed",   // event type (see table below)
  "timestamp": "2026-03-26T18:00:00.000Z",  // ISO 8601 UTC
  "data": {                        // event-specific payload
    ...
  }
}

Event Types & Payloads

Click any event to see its full payload example.

What Your Endpoint Should Return

Kontraktr™ considers a delivery successful if your endpoint returns any2xx status within 10 seconds. Response body is logged (up to 1,000 characters) but not processed.

Any 4xx or5xx status, network error, or timeout triggers the retry schedule. A delivery that times out at 10s counts as a failure.

Return 200 immediatelyand process the payload asynchronously in your own queue. Don't block Kontraktr™ on slow database writes or third-party calls in your handler.

Building something with Kontraktr™?

If you hit an edge case not covered here, our support team understands the technical side. File a ticket and we'll get back to you fast.

Submit a Support Ticket Back to Help Center

Loading…

import { createHmac, timingSafeEqual } from "crypto"; function verifyKontraktrSignature( rawBody: string, secret: string, signatureHeader: string // e.g. "sha256=abc123..." ): boolean { const expected = "sha256=" + createHmac("sha256", secret) .update(rawBody, "utf8") .digest("hex"); // Timing-safe comparison prevents timing attacks return timingSafeEqual( Buffer.from(expected), Buffer.from(signatureHeader) ); }

Header

Value

X-Webhook-Signature

sha256={hex digest}

X-Webhook-Delivery

{deliveryId}

X-Zapier-Event

{event name} (for Zapier endpoints)

X-Hook-Event

{event name} (for Make.com endpoints)

User-Agent

Kontraktr™-Webhooks/1.0

Content-Type

application/json

{ "event": "job.status_changed", // event type (see table below) "timestamp": "2026-03-26T18:00:00.000Z", // ISO 8601 UTC "data": { // event-specific payload ... } }