Webhook events summary

Event delivery

• Webhooks are sent over HTTPS with a POST request.
• Each request includes the X-Nexuscore-Signature header for verification.
• Retries follow exponential backoff for up to 24 hours.

Common events

ticket.created

{
  "id": "evt_01hf...",
  "type": "ticket.created",
  "created_at": "2025-10-12T18:05:11Z",
  "data": {
    "ticket": {
      "id": "tick_01hf...",
      "subject": "Payment pending",
      "brand_id": "brand_123",
      "status": "open"
    }
  }
}

ticket.updated

Includes changed fields and the user or automation responsible.

message.created

Payload contains the message body, author, attachments, and AI draft metadata if relevant.

automation.run.completed

Reports the Mesh recipe, outcome (success, warning, failed), duration, and logs URL.

Verification

1. Concatenate the timestamp and raw body: ${timestamp}.${body}.
2. Compute HMAC-SHA256 with your webhook secret.
3. Compare against the signature in the header.

Example (Node.js):

import crypto from 'node:crypto'

export function verifySignature(body: string, signature: string, secret: string) {
  const digest = crypto
    .createHmac('sha256', secret)
    .update(body, 'utf8')
    .digest('hex')

  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(digest))
}

Retry behavior

After the final attempt the event is marked as failed and visible in the dashboard. You can replay failed events manually.

Testing webhooks

• Use the Send test event button when configuring the endpoint.
• For local development, use tunneling tools (ngrok, Cloudflare Tunnel).
• Inspect delivery logs and sample payloads in Integrations → Webhooks.