Outbound webhooks

​

Add an endpoint

​

Events

​

What you receive

POST /rumorly HTTP/1.1
Content-Type: application/json
User-Agent: Rumorly-Webhooks/1.0 (+https://rumorly.io/docs)
Rumorly-Event: response.classified
Rumorly-Delivery: 5b0f8c52-3c1e-4c3a-9d55-2f7a0c1e9b41
Rumorly-Signature: t=1792656000,v1=6f1c3b…

{
  "id": "5b0f8c52-3c1e-4c3a-9d55-2f7a0c1e9b41",
  "type": "response.classified",
  "created_at": "2026-10-22T08:00:00.000Z",
  "test": false,
  "data": {
    "response": {
      "id": "8d7e0c0b-6a8f-4f0e-bb1a-0d9f2c3e4a51",
      "answer": "My cofounder heard Jake on Lenny's Podcast",
      "question": "How did you hear about us?",
      "source": "widget",
      "status": "classified",
      "answered_at": "2026-10-22T07:59:41.000Z",
      "created_at": "2026-10-22T07:59:41.000Z",
      "metadata": { "utm_source": "google" },
      "person": {
        "id": "1c2d3e4f-5a6b-4c7d-8e9f-0a1b2c3d4e5f",
        "email": "ada@example.com",
        "external_id": "user_123",
        "name": "Ada Lovelace",
        "domain": "example.com"
      },
      "classification": {
        "channel": "podcast",
        "channel_label": "Podcast",
        "entity": { "id": "9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d", "name": "Lenny's Podcast", "kind": "podcast" },
        "proposed_entity": null,
        "entity_is_new": false,
        "confidence": 0.92,
        "method": "llm",
        "reasoning": "Names a podcast episode as the first touch.",
        "overridden": false,
        "classified_at": "2026-10-22T08:00:00.000Z"
      },
      "mrr_cents": 9900,
      "currency": "usd"
    }
  }
}

• Answer quickly with any 2xx. Do the work after you respond. Rumorly waits at most 10 seconds.
• Deduplicate on id (the same value as Rumorly-Delivery). A retry reuses it.
• Order isn’t guaranteed. Compare classification.classified_at if you keep only the latest verdict.
• Repeats are merged. If an answer changes again while its event is still waiting to be delivered, you get one event with the latest state. Saving the same override twice sends nothing new.

​

Verify the signature

1. Read the raw request body, before any JSON parsing.
2. Compute the HMAC and compare it with v1 in constant time.
3. Reject a t more than 5 minutes from your clock, to stop replays.

import crypto from "node:crypto";
import express from "express";

const SECRET = process.env.RUMORLY_WEBHOOK_SECRET; // whsec_…

function verify(rawBody, header) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.trim().split("=")));
  const t = Number(parts.t);
  if (!Number.isInteger(t) || Math.abs(Date.now() / 1000 - t) > 300) return false;
  const expected = crypto.createHmac("sha256", SECRET).update(`${t}.`).update(rawBody).digest();
  const given = Buffer.from(parts.v1 ?? "", "hex");
  return given.length === expected.length && crypto.timingSafeEqual(given, expected);
}

const app = express();
app.post("/rumorly", express.raw({ type: "application/json" }), (req, res) => {
  if (!verify(req.body, req.get("Rumorly-Signature") ?? "")) return res.status(400).end();
  const event = JSON.parse(req.body.toString("utf8"));
  res.status(204).end(); // answer first, then do the work
  handle(event);
});

import hashlib, hmac, json, os, time
from flask import Flask, request, abort

SECRET = os.environ["RUMORLY_WEBHOOK_SECRET"].encode()  # whsec_…
app = Flask(__name__)

def verify(raw_body: bytes, header: str) -> bool:
    parts = dict(p.strip().split("=", 1) for p in header.split(",") if "=" in p)
    try:
        t = int(parts["t"])
    except (KeyError, ValueError):
        return False
    if abs(time.time() - t) > 300:
        return False
    expected = hmac.new(SECRET, f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts.get("v1", ""))

@app.post("/rumorly")
def rumorly():
    if not verify(request.get_data(), request.headers.get("Rumorly-Signature", "")):
        abort(400)
    event = json.loads(request.get_data())
    handle(event)
    return "", 204

​

Retries and failures

• Anything other than a 2xx within 10 seconds is a failed attempt. A redirect counts as a failure, since Rumorly doesn’t follow redirects. Use the final URL.
• A failed delivery is retried up to 8 times with exponential backoff, over roughly 2 to 4 hours.
• After 10 deliveries in a row fail every retry, the endpoint is switched off and the reason is shown in Settings. Any successful delivery resets the count. Fix the receiver, then turn the endpoint back on. Events from the time it was off are not sent again.
• Test events are tried once and never count toward switching an endpoint off.
• A workspace can have at most 5,000 events waiting for delivery. Past that, new events are dropped and counted on the endpoint until the backlog clears.

​

Security

• Only https:// URLs, without user:password@.
• Rumorly resolves your host each time it sends and refuses private, loopback, link-local, cloud-metadata and other reserved addresses. The connection goes to the address it checked.
• If an answer is erased (DELETE /v1/people) before its event goes out, the event is skipped. Erasure doesn’t reach copies already delivered to your endpoint, so erase them there too.