Skip to main content
WEBHOOK

Headers

Carhub-Signature
string
required

t=<epoch>,v1=<hex hmac-sha256 of "<t>.<raw body>">, keyed with the endpoint secret. Compare in constant time and reject a timestamp older than five minutes.

Carhub-Event-Id
string
required

Event identifier, stable across retries — the key to deduplicate on.

Pattern: ^evt_[1-9A-HJ-NP-Za-km-z]{8,32}$
Carhub-Delivery-Attempt
integer
required

1 for the first delivery, incremented on every retry.

Required range: x >= 1

Body

application/json

The envelope of every outgoing webhook. api_version pins the payload shape — it changes only when you upgrade your organisation's API version, never silently.

id
string
required

Stable across retries. Deduplicate on it.

Pattern: ^evt_[1-9A-HJ-NP-Za-km-z]{8,32}$
Example:

"evt_6HbN4rTfKp2W"

type
enum<string>
required

An event your endpoint can subscribe to.

Available options:
job.succeeded,
job.failed,
inspection.stage_completed
Allowed value: "job.succeeded"
api_version
string
required

Contract version the payload was serialised with.

Example:

"2026-08-01"

created
integer<int64>
required

Epoch seconds, UTC.

Example:

1755300000

data
object
required

Response

200

Acknowledged. Any 2xx stops the retry schedule.