Webhooks

Webhooks deliver JSON arrays of CloudEvents 1.0 envelopes (≤ 20 per request). Acknowledge with any 2xx within 10 seconds.

Sweep-Signature: t=1725148800,v1=5257a8…d8bd
Sweep-Webhook-Id: whk_…
Sweep-Delivery-Id: dlv_…

v1 = hex(HMAC-SHA256(secret, t + "." + rawBody)). Reject timestamps older than 5 minutes. During secret rotation both secrets are valid for 24 hours and two v1= values are present.

const events = await sweep.webhooks.constructEvent(rawBody, req.headers["sweep-signature"], process.env.SWEEP_WEBHOOK_SECRET);

from trustysweep import webhooks
events = webhooks.construct_event(raw_body, request.headers["Sweep-Signature"], SECRET)

Retries: 1m, 5m, 30m, 2h, 6h, then every 12h for 3 days, then dead (visible in the console and GET /v1/webhooks/{id}/deliveries). Deduplicate on the CloudEvent id. Test-mode events carry sweepsimulated: true and go only to mode: test webhooks. POST /v1/webhooks/{id}/test sends a signed test event.