Webhooks

Register an HTTPS endpoint for your app in the console and we send it events as they happen. An app can have up to 5 endpoints.

Tareky

Events

Event	When
incident.created, incident.updated, incident.cleared, incident.disputed	A road report in your feed’s area
feed.import.completed, feed.import.failed	An import of the incident feed you publish
geofence.entered, geofence.exited	A device enters or leaves a geofence
quota.threshold	80% and 100% of the month’s units
webhook.test	The console’s test send

Verifying the signature

Messages are signed per Standard Webhooks, so their official libraries work:

import { Webhook } from 'standardwebhooks'

const wh = new Webhook(process.env.TAREKY_WEBHOOK_SECRET) // whsec_…
const event = wh.verify(rawBody, {
  'webhook-id': req.headers['webhook-id'],
  'webhook-timestamp': req.headers['webhook-timestamp'],
  'webhook-signature': req.headers['webhook-signature'],
})

• Verify the raw body, before parsing it as JSON.
• After you rotate the secret, messages carry signatures from both secrets for 24 hours.
• webhook-id stays the same across retries and redeliveries: use it to drop duplicates.

Retries

Answer 2xx within a few seconds. Otherwise we retry after 30 seconds, 2 minutes, 10 minutes, 30 minutes, 1 hour, 3 hours and 12 hours (8 attempts in all).

• Answering 410 Gone switches the endpoint off at once.
• An endpoint failing 5 days in a row is switched off.
• Switch it back on in the console, where you can also redeliver any past message.

We never deliver to internal or private addresses, and the address is checked on every send.