Webhooks | That Is A Q

Setup in 4 Steps

Get your webhook endpoint live in under 5 minutes.

Register Endpoint

Provide a publicly accessible HTTPS URL where we'll POST your payloads.

Subscribe to Events

Choose which events trigger payloads. You can filter by workspace, user, or resource.

Verify Signature

Use our HMAC-SHA256 signature header to ensure payloads are authentic.

Handle & Respond

Return a 2xx status within 3 seconds. We auto-retry failed deliveries up to 3 times.

Events & Payloads

Explore supported events and inspect real payload structures.

All webhooks share a consistent envelope format. Timestamps are UTC ISO-8601. Payloads are gzip-compressed when > 5KB.

Event Code	Description	Frequency
order.created	New order placed successfully	~2,400/day
order.updated	Order status or metadata changed	~850/day
user.updated	User profile or permissions modified	~1,100/day
payment.succeeded	Payment cleared & captured	~3,200/day
error.triggered	System alert or webhook failure	Variable

Fired when a new order is created in the system.

order.created.json
1 {2   "id": "evt_9f8s7d6f5g4h3j2k",3   "type": "order.created",4   "timestamp": "2025-06-15T14:32:10Z",5   "data": {6     "order_id": "ord_a1b2c3d4e5",7     "amount": 149.99,8     "currency": "USD",9     "status": "confirmed"10   }11 }

Fired when a user profile is updated or roles change.

user.updated.json
1 {2   "id": "evt_x9y8z7w6v5u4t3s2",3   "type": "user.updated",4   "timestamp": "2025-06-15T14:35:22Z",5   "data": {6     "user_id": "usr_m3n4o5p6q7",7     "changes": ["role", "email"],8     "previous": { "role": "viewer" },9     "current": { "role": "admin" }10   }11 }

Fired when a system alert occurs or a delivery fails.

error.triggered.json
1 {2   "id": "evt_err_2x3y4z5a6b",3   "type": "error.triggered",4   "timestamp": "2025-06-15T14:40:05Z",5   "data": {6     "code": "WEBHOOK_TIMEOUT",7     "message": "Endpoint did not respond within 3s",8     "retry_count": 1,9     "next_attempt": "2025-06-15T14:40:15Z"10   }11 }

Security & Verification

Protect your endpoint with cryptographic signature validation.

🔐 HMAC-SHA256 Signature Required

Every request includes an X-Q-Signature header. Verify it using your webhook secret to prevent spoofing.

🛡️ TLS 1.2+ Enforced

All webhook deliveries use mutual TLS or standard HTTPS. Self-signed certificates are rejected.

🔄 Idempotency Keys

Each payload includes a unique idempotency_key. Store it to safely handle retries without duplicates.

Node.js Verification Example
1 const crypto = require('crypto');2 const secret = process.env.WEBHOOK_SECRET;34 function verifySignature(payload, signature) {5   const expected = crypto.createHmac('sha256', secret)6     .update(payload, 'utf8')7     .digest('hex');8   return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));9 }

Webhook Tester & Logs

Trigger a test payload and monitor delivery status in real-time.

Endpoint Active https://api.yoursite.com/hooks/q

// Click "Send Test Payload" to generate a sample event...

Delivery Logs

14:32:10✓ Delivered (200)order.created

14:35:22✓ Delivered (200)user.updated

14:40:05↻ Retrying (503)payment.succeeded

Frequently Asked Questions

Everything you need to know about That Is A Q webhooks.

We retry up to 3 times with exponential backoff (30s, 2m, 10m). After the final attempt, the webhook is marked as failed and you'll receive an alert.

Yes. In your dashboard, you can set filters per endpoint using JSONPath expressions or tag-based routing (e.g., env:production, workspace:dev).

We log the response code and body for debugging. The payload is queued for retry according to our backoff policy. Check the Delivery Logs tab for details.

Standard plans allow up to 10,000 deliveries/day. Enterprise plans include dedicated throughput and burst handling. No hard rate limits on your receiving end.