Oway webhooks

Oway webhooks push shipment facts to your HTTPS receiver as they are recorded. Use them to start
work quickly, then use Oway's REST APIs when you need the current system-of-record view.

Each endpoint belongs to one company and one audience. You choose an explicit set of event types
from the live catalog. Each delivered event keeps the same body and signature-verifiable contents across retries.
You can inspect attempts or replay retained deliveries.

The contract at a glance

• Delivery is at least once. Deduplicate on event_id.
• Events can arrive out of order. Use occurred_at, not arrival order.
• Return any 2xx within 15 seconds and move substantial work to your own queue.
• Verify webhook-id, webhook-timestamp, and every v1 value in webhook-signature before
  parsing the body.
• Reject signatures more than five minutes from your clock.
• Store the whsec_... secret shown at endpoint creation or rotation; Oway cannot show it again.
• Treat unknown JSON fields and newly cataloged event types as forward-compatible additions.

Start with the five-minute quickstart, then review
delivery semantics and
signature verification.

Management API

The public management surface is rooted at https://api.oway.io/v1/webhooks. It supports
catalog discovery, endpoint lifecycle, signing-secret rotation, signed tests, delivery history,
and exact-body replay. All effect-producing POST requests require an Idempotency-Key; endpoint
updates also require the latest strong ETag.

External API clients send a bearer JWT and the company-scoped x-oway-api-key. Signed-in portal
users are scoped through active membership. Oway derives company and audience from those
credentials; management requests never accept tenant or audience overrides.

Endpoint URLs and signing secrets are encrypted at rest. A company/audience scope can have up to
25 non-archived endpoints, and each endpoint must explicitly select at least one event.