Developers

Webhook overview

Receive, verify, acknowledge, and process Itemra events reliably.

Create a receiver

Expose an HTTPS endpoint that can read the raw request body. Return a successful response quickly after durable receipt; process business work asynchronously. Keep the endpoint unavailable to normal browser workflows.

Subscribe deliberately

Create a subscription for only the event types the integration uses. Store its signing secret in a secret manager. Use the test-delivery function before enabling production processing.

Verify every delivery

Validate the signature using the documented algorithm, the raw request bytes, and the subscription secret. Reject missing, malformed, stale, or invalid signatures before parsing the event into trusted data.

Expect retries and duplicates

Delivery is at least once. Record the event identifier before processing and make handlers idempotent. Return a non-success status only when retrying the same delivery can help; repeated failures may be moved to dead-letter handling.

Operate the integration

Monitor success rate, processing delay, retries, and dead letters. Rotate secrets with a planned overlap, replay only after correcting the cause, and never log the signing secret or full sensitive payloads.