Delivery envelope

What your customers receive on each HTTPS POST from Outemit.

Body

By default the POST body is the JSON payload you emitted for the event type. Many teams wrap it in a thin envelope for type and timestamp. Example:

json

{
  "id": "evt_01HABC",
  "type": "invoice.paid",
  "timestamp": "2026-09-06T12:00:00.000Z",
  "data": {
    "id": "inv_1",
    "amount": 4900,
    "currency": "usd",
    "status": "paid"
  }
}

Headers

Header	Example	Notes
webhook-id	msg_01HABC	Unique message id. Dedupe on this.
webhook-timestamp	1757131200	Unix seconds. Reject if too skewed.
webhook-signature	v1,SIGNATURE	HMAC-SHA256 over id.timestamp.body with whsec_ secret.
content-type	application/json	Always JSON.

Full algorithm: Signing and verify.

Verify snippets

import { Webhook } from "standardwebhooks";

const wh = new Webhook("whsec_...");
const payload = wh.verify(rawBody, {
  "webhook-id": headers["webhook-id"],
  "webhook-timestamp": headers["webhook-timestamp"],
  "webhook-signature": headers["webhook-signature"],
});