Webhook events.

01 / Setup

Add a webhook endpoint

In the Liulum dashboard, go to Settings > Integrations > Webhooks. Click Add webhook. Paste the HTTPS URL of your endpoint and select the events you want to receive. Care will send a POST request to this URL for each selected event.

02 / Setup

Verify the HMAC signature

Care signs every webhook request with an HMAC-SHA256 signature using your webhook secret. Verify this signature before processing the payload to prevent spoofed requests. The signature is in the X-Liulum-Signature header.

import crypto from 'crypto';

function verifyWebhook(payload: string, secret: string, sig: string) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(sig.replace('sha256=', '')),
  );
}

03 / Setup

Respond quickly, process async

Care expects a 2xx response within 5 seconds. If your endpoint needs more time to process, respond with 200 immediately and process the payload asynchronously (e.g. enqueue a background job). If Care receives a non-2xx or times out, it retries up to 3 times with exponential backoff.

// Respond immediately, then process
export async function POST(req: Request) {
  const body = await req.text();
  // Queue for async processing
  await queue.add({ body });
  return new Response('ok', { status: 200 });
}

04 / Setup

Send a test event

After saving your webhook, click Send test event in the Liulum dashboard. Care sends a sample incident.opened payload to your endpoint. Use this to verify your handler, inspect the payload structure, and confirm the HMAC signature check passes.

05 / Setup

Monitor delivery

In Settings > Webhooks, click your webhook to see the delivery log — every request Care has sent, the response status, response time, and the full request body and response. If a delivery failed, you can replay it from the log.