Webhooks

Lumanu uses webhooks to send real-time notifications about events in your integration. When events occur, we'll send HTTP POST requests to your configured endpoint with signed payloads containing event details.

Security

Each webhook request includes a signature in the X-Signature header. This signature is a HMAC SHA-256 hash of the request body using your webhook secret.

To verify webhook authenticity:

1. Get the signature from the X-Signature header
2. Create a HMAC SHA-256 hash of the raw request body using your webhook secret
3. Compare the hashes - they should match exactly

Example Verification:

const crypto = require('crypto');

function verifyWebhookSignature(body, signature, secret) {
  const hmac = crypto.createHmac('sha256', secret);
  const digest = hmac.update(body).digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(digest)
  );
}

Events

All webhook events follow a standard format:

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "event_type": "entity.event",
  "data": {
    "id": "75eb2d87-1ce7-4e71-a9af-0c3a63547555"
  }
}

The webhook data will contain the identifier of the entity that has changed (i.e. for workspace.created it will be the workspace id). It's recommended that you use this to retrieve the entity from the API to get other fields on that entity as they may have changed since the webhook was created or processed.

Workspace Events

• workspace.created - Triggered when a workspace is created
• workspace.updated - Triggered when workspace details are updated

Payable Events

• payable.created - Triggered when a payable is created
• payable.updated - Triggered when a payable is updated (other than status)
• payable.approved - Triggered when a payable is approved
• payable.unapproved - Triggered when a payable is unapproved
• payable.canceled - Triggered when a payable is canceled
• payable.paid - Triggered when a payable is paid

Transfer Events

• transfer.created - Triggered when a transfer to or from an account is created
• transfer.updated - Triggered when the status of a transfer in an account changes

Partner Events

• partner-invite.claimed - Triggered when an invitation for a vendor is claimed