Webhook overview
Loady webhooks send HTTPS POST requests to a callback URL configured in the company account settings. Contact Loady to enable a webhook and choose a supported trigger, scope, and authentication method.
Callback validation
Before a webhook is accepted, Loady sends an HTTPS HEAD request to the callback URL. Any successful 2xx response passes validation. The URL must be valid and its TLS certificate must be trusted and valid.
For mTLS webhooks, Loady presents the configured client certificate during validation and delivery. During certificate rotation, Loady can fall back to the previous valid certificate after an authentication failure.
Authentication
Choose exactly one:
- HMAC: Loady computes HMAC-SHA256 over the exact UTF-8 JSON request bytes and sends the Base64 result in
x-webhook-signature. Compute the signature before parsing or re-serializing the body and compare it in constant time. - OAuth client credentials: Loady obtains a fresh access token from the configured token URL and sends it as a bearer token. Token URL, client ID, client secret, and optional scope are configured with the webhook.
- mTLS: Loady presents its configured client certificate. Validate the certificate chain, identity, validity, and revocation according to your security policy.
Unauthenticated webhooks are not supported.
Delivery and retries
Only a 2xx callback response is successful. A delivery that throws an HTTP request error is retried up to three times with five seconds between retries. If the queue delivery still fails, Azure retries the message up to 24 dequeue attempts with a one-hour visibility interval; each dequeue runs its own short-retry sequence. Exhausted messages move to the poison queue for Loady operations.
Make callback handling idempotent using WebhookId, Type, Event, Date, and a business identifier in Data. Return 2xx only after the event is durably accepted. Process asynchronously when work cannot complete within the request timeout.
Envelope
Every payload contains:
| Field | Meaning |
|---|---|
WebhookId | Stable webhook configuration ID. |
Name | Webhook configuration name. |
Type | Trigger type listed in Webhook triggers. |
Event | Event that caused delivery. |
Date | UTC event timestamp. |
User.Email, User.Name | User associated with the change. |
Data | Trigger-specific payload. |
See Webhook payloads for the exact runtime-owned fields in each payload family.