The Luscii Webhooks provides subcribing systems with data for events in your Luscii environment. In this guide you will learn how to configure your system to start receiving and processing such events.

Features

Security

Each webhook subscriber is set up with a shared secret. This is used by Luscii to produce a HMAC signature, and by you to verify this signature. The shared secret is a fixed value, the signature is dynamically generated.

Failures and Retries

The requirements for a successful response are:

• The connection must be established within two seconds.
• The response must be received within 10 seconds after establishing the connection.
• The response status code must be between 200 and 299 inclusive.

If any of these requirements are not met, a retry is automatically scheduled, see below. We do not make any distinction between status codes in the 400 range and in the 500 range; in both cases we will retry.

If a failure occurs we support automatic retries. The time in-between tries follows an exponential backoff: 1 minute, 2 minutes, 4 minutes, 8 minutes, 16 minutes, (...). The maximum number of retries is 5, making a total of 6 tries per message.

It's important to note that a message may be delivered more than once! For example if the response from your server was slow, we have no way of knowing whether it was successful. The message may have been successfully processed in this case, but we will still send it again. This means that you are responsible for deduplication. We will ensure that each retried message is identical to the original message. (Same HTTP headers and body.) For deduplication you can use the unique identifier we send in the payload (see examples below, how identifiers are represented depend on the format), or the signature in the header, or you can ensure that processing on your side is idempotent.

Format

Luscii Webhooks currently support messages in a JSON format.

Events