Skip to main content
A webhook is an HTTP POST that Brudcast sends to a URL you own when something happens in your organization. You register the URL once as a webhook endpoint, choose the events it cares about, and Brudcast calls it. You don’t have to poll the API to find out.
Brudcast currently sends two event types: push.token_invalidated and test.event. The email, contact and campaign event types are in the event list and you can subscribe to them, but Brudcast doesn’t send deliveries for them. Event types lists the API calls to use for those instead.

​
How a delivery works

  1. Something happens in your organization. For example, Firebase Cloud Messaging rejects a device token.
  2. Brudcast records one delivery for each active endpoint that subscribes to that event type.
  3. Brudcast checks for due deliveries every five seconds. It sends each one as a JSON POST, signed with the endpoint’s secret.
  4. If your server sends back any HTTP response, the delivery is marked Delivered. If there’s no response before the endpoint’s timeout, or the connection fails, Brudcast tries again later. The wait doubles after each failed attempt, until the endpoint’s Max Retries is used up.

​
Why it works this way

Every request is signed. The X-Webhook-Signature header is an HMAC of the exact request body, keyed with your endpoint’s secret. Anyone can send a POST to a public URL, so check the signature before you trust the body. See Verify signatures. Any response ends the delivery. Brudcast records your status code but doesn’t retry on it. A 500 or 401 from your server counts as delivered, just like a 200. So store the event first, return 200, and process it afterwards. If your code fails after that, you still have the event. Only silence is retried. Brudcast tries again when it gets no HTTP response at all. That includes timeouts, refused connections, DNS failures and TLS errors. Every attempt sends the same body. delivery_id and timestamp don’t change between retries or manual resends. If your server handled a request but Brudcast timed out waiting for the reply, a retry brings the same event back. Record each delivery_id you process and skip repeats.

​
Rules and limits

​
Manage webhooks with the API

Everything in Developers > Webhooks is also available on the platform API, under https://core-service.prod.brudcast.com/api/v1/user. Your API key needs the scope shown.

Create an endpoint

Register a URL, pick events, save the secret and set retries.

Verify signatures

Check the HMAC in Node.js, Python, PHP or Go.

Payload reference

Headers, the envelope and each event’s data.

Event types

What each event means and which are delivered.