Webhooks let Pulsewave push events to your server as they happen, instead of you polling Events or Messages.
Setting up an endpoint
Create a webhook endpoint pointing at a URL on your server, and choose which events to receive:
The response includes a secret starting with whsec_. Save it — you’ll need it to verify incoming payloads, and it’s only shown once.
Event types
Payload shape
Every event has the same envelope:
Verifying signatures
Every request includes a Pulsewave-Signature header. Verify it before trusting the payload, so an attacker can’t spoof events by POSTing to your endpoint directly.
Compute the signature over the raw request body, before your framework parses it as JSON. Re-serializing the parsed body can change whitespace and break the comparison.
Retries
If your endpoint doesn’t return a 2xx within 10 seconds, Pulsewave retries with exponential backoff for up to 24 hours: after 1 minute, 5 minutes, 30 minutes, 2 hours, then every 6 hours. Return 200 as soon as you’ve durably queued the event — do the slow work asynchronously.
Disabling an endpoint
If an endpoint fails repeatedly, Pulsewave automatically sets its status to disabled after 24 hours of consecutive failures and stops sending it events. Re-enable it with Update a webhook endpoint once it’s fixed. 
