Handle webhooks

1. Create an endpoint:

$
curl -X POST $API/api/v1/webhook-endpoints \
>
  -H "Authorization: Bearer $REVENTLOV_API_KEY" \
>
  -d '{"url":"https://example.com/hooks","events":["directive.issued"]}'

2. Save the returned secret — you’ll use it to verify signatures.

3. On your server, verify:

1
import { createHmac, timingSafeEqual } from 'node:crypto';
2
3
export function verify(req: Request, raw: string, secret: string) {
4
  const h = req.headers.get('x-reventlov-signature') ?? '';
5
  const [tPart, vPart] = h.split(',');
6
  const t = Number(tPart.split('=')[1]);
7
  const sig = vPart.split('=')[1];
8
  const expected = createHmac('sha256', secret).update(`${t}.${raw}`).digest('hex');
9
  return timingSafeEqual(Buffer.from(expected), Buffer.from(sig));
10
}

Reject if the timestamp is older than 5 minutes to prevent replay.

Event types

Every state-changing customer action in the dashboard fans out one of these signed events. Subscribe to the ones you care about, or leave events: [] on your endpoint to receive all of them.

Companies

Agents

Filings & compliance

API keys

Case & legal team

Treasury & bank

Agent runtime

Webhook hygiene

Every event payload includes id, type, created_at, account_id, optional company_id, and a data object with the affected record. The full delivery is signed (x-reventlov-signature) and recorded in Activity at /dashboard/logs and Webhooks → Recent deliveries at /dashboard/settings/webhooks.