---
title: "Webhooks"
description: "Subscribing to RIKAISO events, the payload format, signature verification, and retries."
source: "https://help.rikaiso.com/2026.1/webhooks"
version: "2026.1"
latest: true
language: "en"
section: "Integration > Integration Guide"
updated: "2026-09-01"
---

# Webhooks

> Subscribing to RIKAISO events, the payload format, signature verification, and retries.

## Subscribing

Create a subscription in **Administration → Integration → Webhooks**. A subscription names an HTTPS endpoint, the event types to deliver, and a signing secret generated once at creation.

## Payload

Every delivery is a POST with `Content-Type: application/json`:

```json
{
  "id": "evt_9f31c0a4",
  "type": "help.topic.updated",
  "occurredAt": "2026-03-04T09:12:44Z",
  "tenant": "contoso",
  "data": {
    "version": "2026.1",
    "slug": "webhooks",
    "language": "en",
    "actor": "docs-sync"
  }
}
```

## Verifying the signature

The `X-RIKAISO-Signature` header carries `t=<unix>,v1=<hex>`, where `v1` is the HMAC-SHA256 of `<t>.<raw body>` using the signing secret. Compare with a constant-time function and reject deliveries whose timestamp is more than five minutes old.

## Retries

| Attempt | Delay |
| --- | --- |
| 1 | immediate |
| 2 | 30 seconds |
| 3 | 5 minutes |
| 4 | 30 minutes |
| 5 | 2 hours |

A delivery is successful on any 2xx response within ten seconds. After the fifth failure the subscription is paused and an administrator is notified.

> Endpoints must be idempotent. Duplicate deliveries of the same `id` are possible after a network timeout.