Webhooks

Webhooks send an HTTP POST request when activity occurs in your Workspace. Create a subscription for only the event types your integration needs.

Common events include:

• matter.turn_completed when either side returns a completed Turn
• matter.executed when an Executed Copy is stored
• approval.requested when an Approval Chain reaches a new stage
• approval.decided when an approver records a decision

Delivery and retries

Return a success status within five seconds after validating and storing the event. Process slow work asynchronously. If delivery fails or times out, Redline retries after 1 minute, 5 minutes, 30 minutes, 2 hours, and 12 hours. A subscription is paused after 20 consecutive failed deliveries.

Events can arrive more than once and, during retries, out of order. Use the event id for deduplication and the created_at time for ordering within one resource.

Verify a signature

Each request includes Redline-Webhook-Id, Redline-Webhook-Timestamp, and Redline-Webhook-Signature headers. Build the signed content from the identifier, timestamp, and exact request body, separated by periods. Compute an HMAC-SHA256 digest with the subscription secret and compare it with the supplied signature using a constant-time comparison.

Warning:

Reject timestamps more than five minutes from your server time to reduce replay risk. Verify the signature before parsing or acting on the payload.

Return success for an event you have already processed. Use the webhook subscription endpoints to create and manage destinations.