Customer webhooks

Customer webhooks deliver workspace events such as usage and billing lifecycle updates to an endpoint you register in the dashboard. The endpoint URL, enabled events, secret rotation, delivery attempts, and disablement policy are managed server-side.

Verify the signature against the raw request body before parsing JSON. Reject stale timestamps and replayed event IDs, then acknowledge quickly and process asynchronously. Keep the signing secret in a server-side secret manager; it is never included in an SDK or browser example.

X-InferencePass-Event-Id: evt_…
X-InferencePass-Timestamp: 2026-08-27T12:00:00.000Z
X-InferencePass-Signature: v1=…

Event envelopes are versioned and include an event ID, kind, occurred-at timestamp, workspace scope, and payload. Delivery is at-least-once: make consumers idempotent by event ID. Return a 2xx only after the event is durably accepted. Use the dashboard delivery history and request ID correlation when troubleshooting.

Never place provider credentials or customer API keys in webhook payloads. Payloads contain safe event data and identifiers only.