Webhooks

Configure webhook endpoints from Settings → Webhooks. Every event is signed with HMAC-SHA256 using a per-webhook shared secret.

Event catalogue

• pack.delivered — an advisory pack has been delivered to the workspace.
• parity.breach.opened — Parity Watchtower detected a new breach.
• parity.breach.closed — a previously-open breach is now resolved.
• pdpa.request.received — a data-subject request has been logged.
• pdpa.request.forwarded — a guest request has been forwarded to the hotel DPO of record.
• billing.invoice.issued — a Thai VAT invoice has been generated.
• module.activated — a module has been activated on the workspace.
• module.cancelled — a module has been cancelled.

Retry policy

Failed deliveries are retried at 30s, 5min, 30min, 2h, 8h, 24h. After 24h the event is written to a dead-letter queue and made available via GET /webhooks/dlq.

Signature verification

Every request carries a X-THM-Signature header — HMAC-SHA256 of the raw request body using the webhook shared secret. Reject any request whose signature does not verify.