Verify Queue Webhooks - Layarva Documentation

Events

Queue endpoints can subscribe to:

queue.ticket.completed
queue.ticket.no_show

Layarva sends these from the Platform after the operation is applied. An Edge branch that was offline produces webhooks after reconciliation, in Platform order.

Headers

X-Layarva-Event: queue.ticket.completed
X-Layarva-Delivery: 0f0a1c2e-6b1d-4d1a-9a1f-1f2b3c4d5e6f
X-Layarva-Timestamp: 1787220000
X-Layarva-Signature: sha256=<hex>

The signature is:

HMAC-SHA256(secret, timestamp + "." + rawRequestBody)

Verify in Node.js

import { createHmac, timingSafeEqual } from "node:crypto";

function verify({ rawBody, timestamp, signature, secret }) {
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;

  const expected = "sha256=" + createHmac("sha256", secret)
    .update(String(timestamp) + "." + rawBody)
    .digest("hex");

  const a = Buffer.from(expected);
  const b = Buffer.from(signature ?? "");
  return a.length === b.length && timingSafeEqual(a, b);
}

Verify the raw body before JSON parsing. Re-serializing JSON changes the signed bytes.

Delivery handling

Reject timestamps older than five minutes.
Deduplicate work using deliveryId or X-Layarva-Delivery.
Return 2xx to acknowledge delivery.
Layarva waits four seconds for a response.
A 5xx response is retried once; a 4xx response is treated as a deliberate refusal.

Use Send test after configuring the endpoint. Test payloads use the production event shape and include "test": true.

⌘I