Webhooks

Webhooks notify your integration when important reseller account events happen.

Setting Up Webhooks

Configure webhook endpoints in Settings > Webhooks. Use HTTPS, select the events to receive, and set a signing secret when possible.

Webhook Payload

{
  "id": "evt_abc123",
  "type": "company.created",
  "created_at": "2026-01-25T10:30:00Z",
  "data": {}
}

Verifying Webhooks

Each request includes an X-Webhook-Signature header. Compute an HMAC SHA-256 signature with your webhook secret and compare it with a timing-safe check.

$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'];
$secret = 'your_webhook_secret';

$expected = hash_hmac('sha256', $payload, $secret);

if (! hash_equals($expected, $signature)) {
    http_response_code(401);
    exit;
}

Available Events

Event	Description
company.created	A new company was created.
company.updated	Company details changed.
company.suspended	A company was suspended.
company.deleted	A company was deleted.
user.created	A new user was created.
user.updated	User details changed.
user.deleted	A user was deleted.
training.assigned	Training was assigned to users.
training.completed	A user completed training.
training.overdue	A training assignment became overdue.
seats.limit_reached	A company reached its hard seat limit.
seats.limit_exceeded	A company exceeded its soft seat limit.
seats.pool_low	The reseller seat pool dropped below 20%.

Retry Policy

1st retry: 1 minute after the initial attempt.
2nd retry: 5 minutes after the 1st retry.
3rd retry: 30 minutes after the 2nd retry.
4th retry: 2 hours after the 3rd retry.
5th retry: 24 hours after the 4th retry.

After five failed attempts, the webhook is marked as failed and no more automatic retries are attempted.

Best Practices

Return a 2xx response within 30 seconds.
Process heavy work asynchronously.
Use the event ID to prevent duplicate processing.
Always verify the webhook signature.
Use HTTPS for every endpoint.