Webhooks

Overview

Webhooks allow you to build integrations that react to events in Sirv AI Studio. When an event occurs (like an asset being created or processed), we send an HTTP POST request to your configured URL with details about the event.

Available Events

Payload Format

All webhook payloads follow this structure:

{
  "id": "evt_abc123",
  "event": "asset.created",
  "created_at": "2026-01-28T12:00:00Z",
  "data": {
    "asset_id": "ast_xyz789",
    "url": "https://cdn.sirv.com/...",
    "filename": "product-image.jpg",
    "source": "upload",
    "mime_type": "image/jpeg",
    "file_size": 245000,
    "width": 1920,
    "height": 1080
  }
}

Security: Signature Verification

We recommend configuring a secret when creating your webhook. This allows you to verify that requests are genuinely from Sirv AI Studio.

The signature is sent in the X-Webhook-Signature header as sha256=HMAC_HEX.

Node.js Example

const crypto = require('crypto');

function verifySignature(payload, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
  return signature === `sha256=${expected}`;
}

// In your webhook handler:
app.post('/webhook', (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const payload = JSON.stringify(req.body);

  if (!verifySignature(payload, signature, YOUR_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  // Process the webhook...
  res.status(200).send('OK');
});

API Reference

{
  "url": "https://your-server.com/webhook",
  "event": "asset.created",
  "secret": "your-secret-at-least-16-chars"  // optional
}

Retry Policy

• We retry failed deliveries up to 5 times with exponential backoff
• Your endpoint should respond with a 2xx status code within 30 seconds
• After 10 consecutive failures, the webhook is automatically disabled
• You can re-enable disabled webhooks by deleting and recreating them

Headers Sent