Webhook Events Reference

AskBiz webhooks send real-time HTTP POST requests to your specified endpoint when certain events occur in your account. This allows your systems to react immediately to AskBiz events — for example, when an anomaly is detected, a KPI target is hit, or new data is synced.

To configure webhooks:

1. Go to Settings → Developer → Webhooks → Add Endpoint

2. Enter your endpoint URL (must be HTTPS)

3. Select the events you want to receive

4. AskBiz generates a signing secret — store this securely

5. Save — your endpoint will start receiving events immediately

Webhooks are delivered with a 30-second timeout and a maximum payload size of 10MB.

Data events:

• data.sync.completed — a data source has finished syncing
• data.sync.failed — a data source sync has failed
• data.import.completed — a CSV or bulk import has completed

Intelligence events:

• alert.triggered — a custom alert has fired
• anomaly.detected — an anomaly has been detected in your data
• kpi.target.hit — a KPI target has been reached
• daily.brief.ready — your Daily Brief has been generated (sent each morning)

Account events:

• team.member.invited — a new team member has been invited
• team.member.joined — an invitation has been accepted
• subscription.renewed — subscription has been successfully renewed
• subscription.payment.failed — a payment attempt has failed

All webhook payloads share a common envelope:

```json

{

"id": "evt_01HXYZ...",

"type": "alert.triggered",

"created_at": "2025-04-15T09:32:00Z",

"account_id": "acc_01HABC...",

"data": {

// Event-specific payload

}

}

```

The data object contains event-specific fields. For example, an alert.triggered event includes:

```json

"data": {

"alert_id": "alrt_01H...",

"alert_name": "Gross margin below 30%",

"metric": "gross_margin_pct",

"current_value": 27.4,

"threshold": 30.0,

"direction": "below"

}

```

Full payload schemas for all events are documented at developers.askbiz.co/webhooks.

All webhook deliveries include an AskBiz-Signature header for security verification. Always verify this signature before processing the payload.

Verification process:

1. Extract the signature from the AskBiz-Signature header

2. Compute an HMAC-SHA256 of the raw request body using your signing secret

3. Compare your computed signature to the header value using a constant-time comparison function

4. Reject any requests where signatures do not match

Example (Node.js):

```javascript

const crypto = require('crypto');

const sig = req.headers['askbiz-signature'];

const expected = crypto

.createHmac('sha256', process.env.ASKBIZ_WEBHOOK_SECRET)

.update(req.rawBody)

.digest('hex');

const isValid = crypto.timingSafeEqual(

Buffer.from(sig), Buffer.from(expected)

);

```