Skip to main content
WEBHOOK

Authorizations

X-Auth-Token
string
header
required

FlowPayroll JWT (raw token, no Bearer prefix)

Headers

webhook-id
string
required

Unique id for this message. Use it as an idempotency key.

webhook-timestamp
string
required

Unix seconds when this attempt was signed. Reject anything outside a five-minute tolerance to prevent replay.

webhook-signature
string
required

Space-delimited signatures over {id}.{timestamp}.{body}: every v1,{base64} HMAC-SHA256 entry, then every v1a,{base64} ed25519 entry. Verify v1a with the endpoint's public key, which we recommend because a receiver holding only a public key cannot sign events, or v1 with the signing secret, comparing in constant time. More than one of each appears during a secret rotation; accepting any match rotates with no downtime.

X-Flow-Event-Type
string
required

The event type, for routing without parsing the body.

X-Flow-Organisation-Id
string
required

The organisation this event belongs to.

X-Flow-Customer-Id
string
required

The customer that owned the organisation when the event happened. Present on every delivery, and the routing key for a customer-scoped endpoint.

X-Flow-Delivery-Id
string
required

Our id for this delivery. Quote it in a support request.

X-Flow-Delivery-Attempt
string
required

1-based attempt counter.

X-Request-Id
string
required

Correlation id threaded through every FlowPayroll service.

Body

application/json

The signed event envelope. The body is byte-identical across every delivery attempt; verify the signature against these raw bytes.

id
string
type
string
timestamp
string
apiVersion
string
organisationId
string
customerId
string
livemode
boolean
data
object
metadata
object

Response

Any 2xx acknowledges receipt. Respond quickly and do the work asynchronously: an attempt that has not finished within 15 seconds counts as failed.