Developers · Webhooks
Approvals, sealed records, claimed offers, settlements, delivered to your endpoint, signed, with honest retries and full replay.
| Event | Fires when | Payload carries |
|---|---|---|
| proposal.created | A proposal is created for a customer you serve. | proposal id, kind, record ref |
| proposal.approved | The customer explicitly approves, the only execution trigger. | approval id, record ref |
| record.sealed | A record finishes its chain: reason → verify → action → outcome. | record ref, chain digest |
| offer.claimed | A customer claims one of your offers. | offer id, claim id |
| settlement.posted | A commission period settles to your account. | period, statement ref |
| protection.freeze | A customer freezes activity, pause your flows for them. | customer ref (pseudonymous) |
Signatures are HMAC-SHA256 over the raw body with your endpoint secret.
verify · TS
import { verifyWebhook } from "@qoyla/sdk";
app.post("/qoyla/webhooks", (req, res) => {
const event = verifyWebhook(req.body, req.headers["qoyla-signature"], SECRET);
// throws on bad signature, never process unverified payloads
handle(event);
res.sendStatus(200);
});The sandbox sends synthetic events on demand so you can test the full path.