Docs / Webhooks
Webhooks
Subscribe to events and TEO will POST to your endpoint when they fire. The dashboard is the Webhooks page.
Registering an endpoint
POST /v1/webhooks
{
"url": "https://your-app.com/webhooks/teo",
"events": ["booking.confirmed", "booking.cancelled"]
}TEO will issue a challenge GET request to the URL. Return the challenge body as a 200 to verify ownership.
Delivery
Each delivery is a POST with these headers:
Content-Type: application/json TEO-Signature: t=1700000000,v1=5e3b...8d TEO-Event: booking.confirmed TEO-Delivery-Id: dlv_01HXY...
The body is the full event payload.
Verifying the signature
Compute HMAC-SHA256(secret, "{t}.{body}")and compare to the v1 part of theTEO-Signature header. Reject if the timestamp is more than 5 minutes off.
Retries
Failed deliveries (timeout, 5xx, non-JSON response) are retried with exponential backoff: 1m, 5m, 30m, 2h, 6h, 24h. After 24h the delivery is moved to dead-letter and visible in the dashboard.
Rotating the secret
Rotate from the dashboard or call POST /v1/webhooks/{id}/rotate. Both old and new secrets are valid for 24 hours to give your service time to pick up the new value.