Webhooks

Register a URL and eCore will POST to it when an async job finishes, so you don't have to poll. Webhooks are most useful with the Pipeline flow.

Register a Webhook

Method: POST Path: /webhooks/ Full URL: https://backend.ecoreservice.com/api/v1/webhooks/ Auth: Authorization: Token YOUR_API_TOKEN — see Authentication

Field	Type	Required	Description
url	string	Yes	HTTPS URL that will receive delivery POSTs
events	array of strings	Yes	Events to subscribe to: pipeline.completed, pipeline.failed

curl -X POST "https://backend.ecoreservice.com/api/v1/webhooks/" \
  -H "Authorization: Token YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://your-app.com/hooks/ecore","events":["pipeline.completed","pipeline.failed"]}'

The response includes a secret — save it. You use it to verify the signature on every delivery.

Verifying Deliveries

Each delivery is a POST to your URL. The raw request body is signed with your webhook secret using HMAC-SHA256, and the signature is sent in the X-Ecore-Signature header.

Verify every delivery before trusting it:

import hmac, hashlib

ok = hmac.compare_digest(
    hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest(),
    request.headers["X-Ecore-Signature"],
)

Compute the HMAC over the raw, unparsed request body — not a re-serialized version — or the signature won't match.

Delivery Payload

For a pipeline.completed event, the delivery carries the same counts as the pipeline status response (matched / unlocked / verified counts and credits_charged), so you can act on the result without an extra fetch.

List Webhooks

Method: GET Path: /webhooks/

curl "https://backend.ecoreservice.com/api/v1/webhooks/" \
  -H "Authorization: Token YOUR_API_TOKEN"

Delete a Webhook

Method: DELETE Path: /webhooks/{id}/

curl -X DELETE "https://backend.ecoreservice.com/api/v1/webhooks/<id>/" \
  -H "Authorization: Token YOUR_API_TOKEN"