Developers · Webhooks

React to what happens in your library, in real time

Subscribe to fourteen events spanning assets, collections, uploads, sharing, and workflow. Every payload is signed, every delivery is logged, every failed endpoint is handled gracefully so it never wakes you up at night.

Fourteen events, four families

Subscribe to whatever you need. Each endpoint gets exactly the events you ask it for.

Asset events

asset.createdA new asset was added to the library.
asset.updatedAn asset record changed. Includes the list of changed fields.
asset.deletedAn asset was removed. Distinguishes soft from hard delete.
asset.downloadedAn original or rendered file was downloaded. Includes the resolution.

Collection events

collection.createdA new collection was created.
collection.updatedA collection name, parent, or settings changed.
collection.deletedA collection was removed.
collection.assets_addedOne or more assets were added. Bulk-aware.
collection.assets_removedOne or more assets were removed. Bulk-aware.

Sharing events

share.createdA share link was issued.
share.accessedA recipient viewed or downloaded through the share.

Upload & workflow events

upload.batch_completedA batch finished. Includes success and failure counts.
upload.batch_failedA batch ended in failure. Includes the reason.
workflow.transitionedAn asset moved between workflow states.

Payload shape

Compact, predictable, easy to handle

Every payload carries the event name, a timestamp, and a small data object with the IDs you need to look up the full record on the API. Updates also include the list of fields that changed, so you can decide what to refresh without re-fetching everything.

{
  "event": "asset.created",
  "timestamp": "2026-05-06T08:30:14Z",
  "data": {
    "asset_id": 18432,
    "gaid": "IM-20260506-3F9A2C8B0D"
  }
}

Signature verification

HMAC-SHA256 on every delivery

Compute the signature with your endpoint secret, compare in constant time, then trust the body. The same secret survives rotation: when you rotate, the previous secret keeps validating for twenty-four hours so you can deploy at your own pace.

// Verify a webhook signature (Node.js)
import crypto from 'crypto';

function verifyWebhook(payload, signatureHeader, secret) {
    const expected = crypto
        .createHmac('sha256', secret)
        .update(payload)
        .digest('hex');

    return crypto.timingSafeEqual(
        Buffer.from(expected),
        Buffer.from(signatureHeader),
    );
}

Delivery you can stop worrying about

Webhooks are a category of integration that ages badly. We tried to absorb the rough edges so your handler stays small.

Signed payloads

Every delivery carries an HMAC-SHA256 signature computed with your endpoint secret. Verify on receive, then trust the body.

Automatic retries

Transient failures retry on a backoff. Endpoints that fail consistently are paused so they don’t fill your inbox or queue.

Auto-disable on persistent failure

After ten consecutive failed deliveries, the endpoint is auto-disabled. You can re-enable it after fixing the issue.

Secret rotation with grace period

Rotate an endpoint’s secret without downtime. The old secret keeps verifying for twenty-four hours so you can roll your handler at your own pace.

Delivery history

Every delivery attempt is recorded with the timestamp, status code, response body excerpt, and retry count. Replay or inspect anything from the API.

Test deliveries on demand

Send a synthetic event from the API or settings to confirm your handler is wired up correctly before going live.

Developers · Webhooks

Wire your library into the rest of your stack

Take the demo for a spin and register your first endpoint, or browse the management API to wire it up programmatically.