Webhooks

Webhooks

AYA signs outbound deliveries so you can verify they are real

Signed delivery matters as soon as results start flowing into automation, backend pipelines, or other systems that should not trust arbitrary callbacks.

Aya-Signature: t=1772972000, v1=<hex-hmac>
{  "event": "job.completed",  "sent_at": "2026-04-18T12:00:00.000Z",  "data": {    "job_id": "2d6c...",    "operation": "concept-tests.run"  }}

Verification

Verify the signature before you trust the body

The console can create webhook destinations and send signed test events. Your endpoint should validate the signature using the one-time secret shown at creation.

import crypto from 'crypto';
function verifyAyaSignature(rawBody, signatureHeader, secret) {  const parts = Object.fromEntries(    signatureHeader.split(', ').map((part) => part.split('='))  );
  const expected = crypto    .createHmac('sha256', secret)    .update(`${parts.t}.${rawBody}`)    .digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));}

Console flow

Manage endpoints from the console

Create a webhook, store the signing secret immediately, test delivery, and review recent outcomes from the Logs and Settings areas.