Receive a delivery lifecycle event
HaulStow sends this request to each active subscribed webhook endpoint.
Delivery is at least once: deduplicate with the stable event id.
Verify Haulstow-Signature over
<unix_timestamp>.<exact_raw_request_body> using HMAC-SHA256 and reject
timestamps more than five minutes old. During secret rotation the header
can contain two v1 signatures; accept either valid value.
Headers
t=<unix_timestamp>,v1=<hex-digest>[,v1=<previous-hex-digest>]
^evt_[a-f0-9]{32}$"evt_47351d65d53840ce8f4ff7d6d83f1be9"
Identifies this callback delivery attempt stream. Manual replay gets a new value.
^whd_[a-f0-9]{32}$"Haulstow-Webhooks/1.0"Body
^evt_[a-f0-9]{32}$"evt_47351d65d53840ce8f4ff7d6d83f1be9"
delivery.created, delivery.assigned, delivery.picked_up, delivery.in_transit, delivery.delivered, delivery.failed, delivery.cancelled, delivery.outsourced, webhook.test "2026-08-20"test, live "live"
x >= 1Response
Callback accepted. Any 2xx response marks delivery successful.
