Signed completion webhooks

Register and receive

Configure your callback under Settings → Webhooks in the dashboard. The documented completion payload contains event, jobId, fileStatus, documentType and timestamp.

{
  "event": "job.completed",
  "jobId": "job_example",
  "fileStatus": "done",
  "documentType": "invoice",
  "timestamp": "2026-09-08T10:00:00.000Z"
}

Verify the signature

The x-number7ai-signature header is a hex-encoded HMAC-SHA256 digest of the raw request body. Compute the digest with your webhook secret and compare in constant time. Do this before parsing JSON.

import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifyWebhook(rawBody, signature, secret) {
  if (!Buffer.isBuffer(rawBody) || !secret ||
      typeof signature !== 'string' ||
      !/^[a-f0-9]{64}$/i.test(signature)) return false;
  const actual = Buffer.from(signature, 'hex');
  const expected = createHmac('sha256', secret)
    .update(rawBody).digest();
  return actual.length === expected.length &&
    timingSafeEqual(actual, expected);
}

Handle retries safely

Persist verified events before acknowledging them and process work asynchronously. Delivery can repeat: deduplicate by jobId and the terminal state before triggering side effects. Retrieve the result through the authenticated results endpoint. The published policy describes up to three retries for non-2xx responses.