Webhooks

Aoexl can forward completion events to license-scoped webhook endpoints.

Event Flow

When a signing session completes, the product can:

1. upload completion artifacts
2. build the completion payload
3. sign the payload with HMAC when a secret exists
4. retry failed deliveries with backoff
5. store delivery logs

Headers

• X-Aoexl-Event
• X-Aoexl-Event-Version
• X-Aoexl-Signature

Payload Notes

The payload includes event metadata plus completion data such as:

• signed PDF URL
• certificate URL
• storage metadata
• completion timestamp
• IP address when available

Security

If a webhook secret is configured, requests include an HMAC signature:

X-Aoexl-Signature: sha256=<signature>

Verify the signature with the raw request body:

import crypto from "node:crypto";

function verifyAoexlWebhook(rawBody, signatureHeader, secret) {
  const expected =
    "sha256=" +
    crypto.createHmac("sha256", secret).update(rawBody).digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(signatureHeader),
    Buffer.from(expected)
  );
}

Operations Support

The Developers area currently exposes:

• webhook URL/secret management
• recent delivery logs
• configuration audit trail