Webhooks
Webhooks send signed outbound POST requests for selected tenant events. Manage endpoints from Settings -> Integrations -> Webhooks or the public API.
Contracts
| Event | Status | Delivery |
|-------|--------|----------|
| inventory.item.created | Emitted | Signed outbox delivery |
| inventory.item.updated | Emitted | Signed outbox delivery |
| order.created | Emitted | Signed outbox delivery |
| order.updated | Emitted | Signed outbox delivery |
| user.invited | Emitted | Signed outbox delivery |
| organization.updated | Emitted | Signed outbox delivery |
| integration.connected | Emitted | Signed outbox delivery |
| bom.created | Planned | Contract reserved, not emitted yet |
| bom.updated | Planned | Contract reserved, not emitted yet |
| webhook.test | Test only | Unsigned connectivity check |
Signing
Production deliveries include:
X-FabHub-EventX-FabHub-TimestampX-FabHub-Signature
Verify the signature over the exact raw request body before parsing. The SDK exports verifyFabHubWebhookSignature for this.
Secret rotation
Rotate a webhook secret with PATCH /v1/webhooks/{webhook_id} and {"rotateSecret": true}. The new secret is returned once. During the overlap window, deliveries may include signatures for both current and previous secrets.
Delivery logs
Use GET /v1/webhooks/{webhook_id}/deliveries to inspect outbox delivery status. Synthetic test pings do not appear in the outbox log.