Webhooks

The signed delivery engine is live, but self-serve endpoint management is not currently exposed in the app. Treat webhooks as limited availability until PageReflect has configured an endpoint for your organization; email notifications remain the self-serve option.

Configured endpoints can receive `report.created` when a fresh report is scored and `run.completed` when a run finishes. Other event names may appear in internal schemas but are not delivered today.

Self-serve endpoint creation is not exposed in the current settings UI. Contact PageReflect support if you need limited-access setup. Endpoint URLs must use public HTTPS, and the signing secret starts with `whsec_` and is shown once.

A configured endpoint can receive a synthetic test delivery before you rely on real events. Store the signing secret securely; PageReflect stores only the encrypted value and cannot show the original again.

The body is JSON describing the event. Three headers accompany every delivery: `X-PageReflect-Event` (the event type), `X-PageReflect-Delivery` (a unique id for this attempt), and `X-PageReflect-Signature` (the signature, below).

The signature header looks like `t=<unix_seconds>,v1=<hex>`. The `v1` value is an HMAC-SHA256 over the string `<timestamp>.<raw body>`, keyed with your signing secret.

Compute the expected signature over the exact raw request body (not a re-serialized object) and compare it to `v1` with a constant-time comparison. Reject the delivery if the header is missing either part or the comparison fails.

Return a 2xx quickly to acknowledge a delivery. If your endpoint errors or times out, PageReflect retries with exponential backoff. Every attempt is recorded in a deliveries log you can inspect, and you can replay any past delivery from there once your endpoint is fixed.

Design your handler to be idempotent: use the `X-PageReflect-Delivery` id (or the event id in the body) to ignore a delivery you have already processed.