Signature
Webhook endpoints receive job and account events. Payloads are signed with HMAC-SHA256.
X-Paperoffice-Signature: sha256=<hex_hmac>
Compute: HMAC_SHA256(webhook_secret, raw_request_body)
Reject the request if the signatures do not match.Events
Events: job.completed, job.failed, job.progress, document.*, workspace.*, task.* or *.
Account-level notices (empty wallet, revoked key) are not webhook events.
Subscription
Webhooks are registered, listed, updated, tested and deleted via the API.
| Endpoint | Action |
|---|---|
POST /webhooks/subscribe | Register a webhook |
GET /webhooks/list | List subscriptions |
POST /webhooks/update | Update a subscription |
POST /webhooks/test | Test delivery |
POST /webhooks/delete | Delete a subscription |
Live parameter lists: llms.txt.