Subscription model
You register an HTTPS URL viaPOST /v1/webhooks. iBubbl returns a subscription with a signing secret. You can register multiple subscriptions per account — one per environment, one per service, or one filtered to a subset of event types.
event_types (or pass null or []), the subscription receives all events, including event types added later. See the Webhook Events catalog for the full list.
Changing a subscription
Subscriptions can’t be edited. To change the URL or the event filter, create a new subscription, switch your endpoint to its new signing secret, then revoke the old one. Both receive events while they overlap, with the same eventids, so your de-duplication covers the switch.
The signing secret
The create response includes asecret field (format: whsec_<64 hex chars>). This is the only time the full secret is returned. Store it immediately in your secrets manager.
You use the secret to verify the X-iBubbl-Signature header on every incoming webhook POST, ensuring the request actually came from iBubbl and wasn’t forged. See Signature verification for the algorithm and reference verifiers in Python + Node.
If you lose the secret, revoke the subscription and create a new one — iBubbl cannot recover or re-display it.
Delivery and retries
Delivery is at least once, in no guaranteed order. Your endpoint must return a2xx within 10 seconds; anything else, including a 3xx or a timeout, is retried up to 5 attempts over about 37 minutes, then marked dead. De-duplicate on the event id. Retries and deduplication has the exact schedule, what iBubbl does and doesn’t do after a failure, and de-duplication code.
Best practices
Return 2xx fast
Return 2xx fast
Process asynchronously. iBubbl’s 10s timeout is firm; slow endpoints look like failures and trigger unnecessary retries.
De-duplicate on the event ID
De-duplicate on the event ID
Use the event
id, plus data.message_id and type for the rare change recorded twice. Never de-duplicate on content. See Retries and deduplication.Verify signatures on every request
Verify signatures on every request
Don’t make exceptions for “internal” testing or “trusted” networks. Signature verification is cheap and catches forged requests + misrouted traffic. See Signature verification.
Watch the dashboard webhook log
Watch the dashboard webhook log
Settings → Webhooks → Recent deliveries shows every attempt, its HTTP status and retry state. Use it to spot endpoints that are silently failing. To try it out, see Test webhooks locally.
What’s next
Webhook Events
The catalog of event types and their payload shapes.
Signature verification
HMAC-SHA256 verification with reference code in Python + Node, and a test vector.
Retries and deduplication
The retry schedule, and handling duplicates and out-of-order events.
Test webhooks locally
Receive real events on your laptop through a tunnel.

