Webhooks

Webhooks let Layers POST to your endpoint when something happens. Configured today via the Partner API (create / list / rotate / replay endpoints); see API reference → Webhooks.

Signature header

Each delivery carries a single header:

X-Layers-Signature: t=<unix>,v1=<hex-hmac>

The MAC is HMAC-SHA256(secret, "${t}.${rawBody}"). Reject timestamps more than 5 minutes off your clock. Multiple v1= entries represent the 24-hour rotation overlap window — accept any one that verifies.

Full verification guidance (Node + Python samples), rotation mechanics, retry/backoff policy, and the delivery log are in API → Webhooks.

Event catalog

You can subscribe to any of these:

• job.completed, job.failed, job.canceled
• content.generated, content.approved, content.rejected
• post.scheduled, post.published, post.failed, post.canceled
• social_account.connected, social_account.needs_reauth, social_account.revoked
• lease_request.assigned, lease_request.rejected
• test.ping

Optimizer, wallet, and billing webhook event types are not yet emitted. Don't subscribe to names outside the list above — the endpoint rejects them.

Retry policy

• HTTP 2xx: success.
• HTTP 4xx (except 429): no retry.
• HTTP 5xx / 429 / network: retry with backoff, up to 5 attempts. Then the delivery is marked abandoned.

Testing

Send a test.ping via the API; see Webhook test.

Deliveries log

Every delivery is logged with timestamp, URL, status, and retry count. Replay via POST /v1/webhook-deliveries/:deliveryId/replay.