Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.getovra.com/llms.txt

Use this file to discover all available pages before exploring further.

Webhooks are how Ovra tells your systems that something happened. Every state-changing operation fires one. Deliveries are HMAC-SHA256-signed, retried on a plan-tier-aware backoff schedule, and SSRF-checked against private IPs and metadata endpoints.

​
Subscribe

curl -X POST https://api.getovra.com/webhooks \
  -H "Authorization: Bearer $OVRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-server.com/ovra/webhook",
    "events": ["transaction.completed", "intent.approved", "claim.request.paid"],
    "description": "Production webhook"
  }'
Use ["*"] to subscribe to every event. URL constraints (isBlockedWebhookUrl):
  • HTTPS or HTTP (HTTPS strongly recommended in prod)
  • No localhost
  • No RFC 1918 (10.0.0.0/8, 172.16/12, 192.168/16)
  • No link-local (169.254.0.0/16) or metadata endpoints (169.254.169.254, metadata.google.internal)
  • DNS rebinding check at delivery time

​
Event catalog

There are ~50 event types across these categories. Source of truth: apps/api/src/services/webhook.ts WebhookEvent union.
intent.created · intent.approved · intent.denied · intent.expired · intent.cancelled · intent.matched (reserved) · intent.mismatched (reserved)
transaction.created · transaction.updated · transaction.authorization · transaction.settlement · transaction.settled · transaction.completed · transaction.declined · transaction.refunded
card.issued · card.activated · card.frozen · card.unfrozen · card.closed · card.rotated · card.funded · card.shipped · card.limits_changed · card.details_changed
card_limit_request.updated
wallet.created · wallet.funded · wallet.credited
transfer.completed · transfer.failed · transfer.split.completed
risk.agent_frozen · risk.review_required · risk.alert_created · risk.denied · risk.velocity_alert · risk.geo_impossible
agent.created · agent.frozen · agent.unfrozen
claim.request.created · claim.request.paid · claim.request.expired · claim.request.cancelled
dispute.created · dispute.updated · dispute.resolved
mpp.credential.minted · mpp.credential.consumed · mpp.credential.expired (reserved) · mpp.transaction.completed
verification.mismatch · mobile_wallet.updated · payment.updated · receipt.updated · bill.updated · cardholder.updated

​
Delivery format

Headers:
HeaderValue
X-Ovra-EventEvent name
X-Ovra-TimestampUnix seconds at signing
X-Ovra-Delivery-IdUnique per attempt
X-Ovra-Signaturesha256=<hex> HMAC-SHA256 of {deliveryId}.{timestamp}.{rawBody}
X-Request-IdCorrelation back to the originating request
Body: 
{
  "event": "transaction.completed",
  "createdAt": "2026-04-20T12:34:56.789Z",
  "data": {
    "transactionId": "tx_...",
    "agentId": "ag_...",
    "intentId": "int_...",
    "amountEuros": 4.51,
    "merchant": "hetzner.com",
    "status": "completed"
  }
}

​
Verify the signature

import { createHmac, timingSafeEqual } from "node:crypto";

function verify(req: { headers: Record<string,string>, rawBody: Buffer }, secret: string) {
  const sig = req.headers["x-ovra-signature"] ?? "";
  const ts  = req.headers["x-ovra-timestamp"] ?? "";
  const id  = req.headers["x-ovra-delivery-id"] ?? "";
  const expected = "sha256=" + createHmac("sha256", secret)
    .update(`${id}.${ts}.${req.rawBody.toString("utf8")}`)
    .digest("hex");
  return timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
}

​
Retry policy (plan-tier-aware)

TierMax attemptsBackoffDead-letter
basic1––
full1––
full_retry51m · 5m · 15m · 1h · 4h–
full_dlq5Same as above✓
Background poller runs every 30s, claims rows via FOR UPDATE SKIP LOCKED so multi-instance API hosts never double-deliver.
PlanWebhook tier
Freebasic
Starterfull
Businessfull_retry
Enterprisefull_dlq

​
Best practices

  • Verify signatures before processing — never trust the body unsigned.
  • Idempotent handlers — the same event may deliver more than once.
  • Acknowledge fast — return 2xx within 30s. Defer slow work to a queue.
  • Check the timestamp window to reject very old replays.

​
Next

Intelligence

Audit + decision logs supplement webhooks for forensics.

Sandbox

Test signature verification end-to-end.