Supported Events
Registering an Endpoint
Event Payload Shape
Every webhook POST has the same envelope:grant.created
grant.revoked
cascade: true means descendant grants were also revoked.
token.issued
Verifying Signatures
Every request includes anX-Grantex-Signature header with a hex-encoded HMAC-SHA256 signature of the raw request body:
Always verify signatures before trusting the payload. Use the raw request body — not the parsed JSON.
SDK Usage
Delivery Behaviour
- Grantex delivers webhooks with a 10-second timeout per request.
- Your endpoint should return any 2xx status to be considered successful.
- Respond quickly (under 5s) and do heavy processing asynchronously.
- Failed deliveries are retried with exponential backoff.