Webhooks

Database webhooks notify an external URL whenever rows change — useful for syncing to other systems, triggering jobs, or kicking off workflows.

Create a webhook

In Settings → Webhooks for your project: add a name and endpoint URL, choose the events (INSERT, UPDATE, DELETE), and optionally scope it to a single table. Save and copy the signing secret shown once. Use Send test to deliver a sample ping event.

Prefer the terminal? The CLI has orbitnest webhooks create|list|test|delete, and the MCP exposes the same operations to AI agents.

Payload

{
  "event": "INSERT",
  "delivered_at": "2026-06-19T12:00:00.000Z",
  "table": "orders",
  "schema": "public",
  "record": { "id": "…", "total": 42 },
  "old_record": null
}

Headers include X-Orbitnest-Event and X-Orbitnest-Signature.

Verifying the signature

The signature is sha256= + HMAC-SHA256 of the raw request body using your signing secret. Always verify before trusting a payload.

import { createHmac, timingSafeEqual } from 'crypto';

function verify(rawBody: string, signature: string, secret: string): boolean {
  const expected = `sha256=${createHmac('sha256', secret).update(rawBody).digest('hex')}`;
  const a = Buffer.from(signature);
  const b = Buffer.from(expected);
  return a.length === b.length && timingSafeEqual(a, b);
}

Delivery & retries

• Each delivery times out after 10 seconds.
• Retries once on a network error or a 5xx response.
• A 4xx is treated as a permanent rejection (not retried).
• Every attempt is recorded in the delivery log with its status code.