The Webhook

A webhook subscription delivers Partner API events to your HTTPS URL. Store webhookSecret from the 201 response; it is not returned again.

A webhook subscription tells OnboardMe to POST JSON to your HTTPS URL when something happens in the practice. One subscription per event. Repeat the create call with the same URL to cover multiple events.

Write access is required to subscribe. List event keys first with GET /api/v1/webhooks/events.

See Webhooks.

Attributes

id · uuid

Subscription id. Use it to test or delete the subscription.

url · string

Your HTTPS endpoint.

event · string

Event key such as proposal.accepted or eform.submitted.

webhookSecret · string

Returned once on create (201). Store it immediately. List and get routes do not return it again.

Delivery headers

Header	Meaning
X-Om-Event	Event key
X-Om-Event-Id	Unique id. Use as an idempotency key.
X-Om-Timestamp	Unix seconds (UTC) used when signing
X-Om-Signature	sha256= HMAC (hex, lowercase)

Verify: canonical = {timestamp} + "." + {rawBody}, then HMAC-SHA256 with webhookSecret.

The Webhook object

{
  "id": "0f1e2d3c-4b5a-6978-90ab-cdef12345670",
  "url": "https://partner.example.com/webhooks/onboardme",
  "event": "proposal.accepted",
  "webhookSecret": "whsec_store_this_immediately"
}