Subscribing

Create a subscription in Administration → Integration → Webhooks. A subscription names an HTTPS endpoint, the event types to deliver, and a signing secret generated once at creation.

Payload

Every delivery is a POST with Content-Type: application/json:

{
  "id": "evt_9f31c0a4",
  "type": "help.topic.updated",
  "occurredAt": "2026-03-04T09:12:44Z",
  "tenant": "contoso",
  "data": {
    "version": "2026.1",
    "slug": "webhooks",
    "language": "en",
    "actor": "docs-sync"
  }
}

Verifying the signature

The X-RIKAISO-Signature header carries t=<unix>,v1=<hex>, where v1 is the HMAC-SHA256 of <t>.<raw body> using the signing secret. Compare with a constant-time function and reject deliveries whose timestamp is more than five minutes old.

Retries

A delivery is successful on any 2xx response within ten seconds. After the fifth failure the subscription is paused and an administrator is notified.

Endpoints must be idempotent. Duplicate deliveries of the same id are possible after a network timeout.