Server API · v1

Webhook integration

Create a Project HTTP hook for one of video:ready, video:readyall, or video:failed. The first means an output is playable; the second means every planned output is complete; the third means processing cannot finish without action. A ready and readyall event can be created in one lifecycle transaction. Events carry a stable event ID and public Media Asset ID, never provider callback details.

Authenticate deliveries

Read the raw UTF-8 body before JSON parsing. Verify WeCloud-Signature, a v1= HMAC-SHA256 over WeCloud-Timestamp + '.' + rawBody, using the hook signing secret. Reject timestamps more than five minutes from your clock. Deduplicate by WeCloud-Event-Id, acknowledge quickly with any 2xx response, and process asynchronously. Delivery order is best effort, especially across retries and redelivery.

The first delivery follows commit. Failures retry after 1 minute, 5 minutes, 30 minutes, 2 hours, 8 hours, and 24 hours. The receiver has ten seconds to acknowledge. Dashboard Webhooks shows safe delivery history and supports manual redelivery. Rotating the signing secret creates a 24-hour overlap, during which WeCloud-Signature-Next carries the new signature. The plaintext new secret is shown once. API Secrets and webhook signing secrets serve different purposes.