Outgoing webhooks

With the Outgoing webhooks module on, RoWarden sends a signed JSON request to your own https address when something happens in the experience. Only the owner manages them by default, because a webhook leaves RoWarden.

What you can receive

Pick groups of events per webhook, or none to receive all of them: staff, teams and promotions; staff records; time off; sessions and shifts; assignments and quotas; orders; and moderation. Each request carries the event name, the experience, when it happened, who did it (a label and where from), what it concerned, and the same details the Discord log would show. Secrets and private fields are removed first.

Verifying a request

Every request has the header X-RoWarden-Signature: t=<unix seconds>,v1=<hex>. The v1 value is the HMAC-SHA256, in hex, of the text <t>.<raw request body> made with your signing secret. Reject anything older than a few minutes. The secret (whsec_…) is shown once when you add the webhook or rotate it, and is stored encrypted.

Rules and retries

• Only public https addresses are allowed. Addresses that point to private or internal networks are refused when you add them and again when RoWarden connects.
• A delivery succeeds on any 2xx answer. Otherwise it is retried after 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours, then marked failed. You can retry a failed delivery by hand.
• A webhook that fails 20 times in a row is switched off, and the people who manage webhooks are notified. Re-enable it after fixing your server.
• Use Send a test to receive a ping event.
• Up to five webhooks per experience. The delivery log shows the last attempts.