Webhooks

{"event": "transcript.completed", "id": "tr_01k6z...", "status": "completed", "metadata": {"meeting_id": 42}}

• To add your own header to each delivery, set webhook_auth_header_name and webhook_auth_header_value on the request.
• webhook_url must be a public http(s) address. Redirects are not followed.
• Canceled jobs send no webhook.

​

Verify signatures

# pip install standardwebhooks
import os
from standardwebhooks.webhooks import Webhook, WebhookVerificationError

wh = Webhook(os.environ["AIRCAPS_WEBHOOK_SECRET"])
try:
    event = wh.verify(request_body_bytes, request_headers)   # raw body bytes and the request headers
except WebhookVerificationError:
    ...                                                       # reject with 400

1. Base64-decode the secret without its whsec_ prefix.
2. Compute HMAC-SHA256 with it over {webhook-id}.{webhook-timestamp}.{raw body} and base64-encode the result.
3. Compare it in constant time with the value after v1, in webhook-signature.
4. Reject timestamps more than 5 minutes old.

​

Delivery

• Reply with any 2xx within 15 seconds.
• Failures (including timeouts, network errors and 3xx) are retried for about 24 hours: after 30 s, 2 min, 10 min, 30 min, 1 h, 2 h, 4 h, 8 h and 8 h.
• A 4xx other than 408 or 429 stops retries.
• webhook-id is stable across retries of one event; use it to deduplicate.
• The transcript shows webhook_status (pending, delivered or failed) and the last HTTP status as webhook_status_code.
• Rotating the secret applies to pending retries too.