> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clipstake.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhooks

> Receive signed account and tracked media events.

Configure webhook endpoints in the Console. Endpoint IDs use the `whk_` prefix.

## Event types

Known event types are:

* `submission.updated`
* `submission.unavailable`
* `account.connected`
* `account.updated`

Treat `type` as an open string. Clients must ignore or safely store unknown
event types.

`account.updated` reports connection or tracking changes. It can report a
reconnect requirement, a revocation, or a parked-state change.

## Payload

```json theme={null}
{
  "id": "evt_4f9c0a1b2c3d4e5f60718293",
  "type": "submission.updated",
  "created_at": "2026-09-14T10:00:00.000Z",
  "data": {
    "id": "sub_4f9c0a1b2c3d4e5f60718293",
    "platform": "instagram",
    "metadata": { "campaign": "fall" }
  }
}
```

`data` matches the related REST resource. Full resource metadata is included.
Analytics fields follow the workspace's analytics access.

## Verify signatures

Read `Pulse-Signature`. It has the form `t=<unix>,v1=<hex>`.

Compute HMAC-SHA256 over `${t}.${rawBody}` with the endpoint secret. Compare
the hex digest in constant time. Verify the raw request body before parsing it.

Reject timestamps more than 5 minutes from the current time. During secret
rotation, verify with both the current and previous secrets.

## Delivery behavior

Delivery is at least once. Deduplicate by the `evt_` ID. Events have no ordering
guarantee, so compare resource timestamps when order matters.

ClipStake retries failures with backoff for approximately 24 hours. An HTTP
`410` response disables the endpoint.