RESOURCES → DEVELOPER CENTER → WEBHOOKS
A governed event-integration environment: event types, payloads, signatures, delivery semantics, retries, ordering, idempotency and monitoring — designed so consumers can build safely.
How can applications respond to meaningful DISHA events without repeatedly polling for changes?
genome.evidence.created
Trigger: A verified evidence object is created · Meaning: New capability evidence exists for a person
Payload: event_id · type · version · timestamp · person_id · evidence_id · provenance
Schema v1.1 · Ordering: Per person, per type · Retry: Exponential backoff, max 5, then dead-letter
Duplicates: Possible — idempotency by event_id required · Signature: HMAC-SHA256 header + timestamp
readiness.state.changed
Trigger: Readiness state transitions for a person · Meaning: Qualified/available/constraint state changed
Payload: event_id · type · timestamp · person_id · from_state · to_state · disclosure
Schema v1.0 · Ordering: Per person · Retry: Exponential backoff, max 5
Duplicates: Possible · Signature: HMAC-SHA256 header + timestamp
learning.completed
Trigger: A learning item completes with evidence · Meaning: Training evidence is available in the Genome
Payload: event_id · timestamp · person_id · learning_id · evidence_id
Schema v1.0 · Ordering: Per person · Retry: Max 5, dead-letter
Duplicates: Possible · Signature: HMAC-SHA256
talent.workflow.stage.changed
Trigger: Candidate moves workflow stage · Meaning: Pipeline state changed for a requisition
Payload: event_id · timestamp · requisition_id · candidate_id · from_stage · to_stage
Schema v1.2 · Ordering: Per candidate · Retry: Max 5
Duplicates: Possible · Signature: HMAC-SHA256
ai.task.completed
Trigger: An AI agent task finishes · Meaning: Labeled agent output is ready with sources
Payload: event_id · timestamp · task_id · agent · status · output_ref
Schema v1.0 · Ordering: Per task · Retry: Max 5
Duplicates: Possible · Signature: HMAC-SHA256
profile.updated
Trigger: Consented profile fields change · Meaning: Person profile updated within consent scope
Payload: event_id · timestamp · person_id · changed_fields
Schema v1.1 · Ordering: Per person · Retry: Max 5
Duplicates: Possible · Signature: HMAC-SHA256
marketplace.listing.changed
Trigger: Listing created/updated/withdrawn · Meaning: Marketplace catalog changed
Payload: event_id · timestamp · listing_id · change
Schema v1.0 · Ordering: Per listing · Retry: Max 5
Duplicates: Possible · Signature: HMAC-SHA256
admin.retention.executed
Trigger: Retention policy executes on records · Meaning: Data lifecycle action taken (audit-logged)
Payload: event_id · timestamp · scope · count
Schema v1.0 · Ordering: None · Retry: Max 3
Duplicates: Low — administrative · Signature: HMAC-SHA256
Pick an event and a language, then simulate success or failure to inspect the handler code and the retry sequence. Payloads are clearly-labeled illustrative fixtures — nothing is delivered anywhere.
import { createHmac, timingSafeEqual } from "node:crypto";
export async function POST(req: Request) {
const raw = await req.text(); // verify the RAW body
const sig = req.headers.get("x-disha-signature") ?? "";
const expected = createHmac("sha256", process.env.DISHA_WEBHOOK_SECRET!)
.update(raw).digest("hex");
if (!timingSafeEqual(Buffer.from(expected), Buffer.from(sig.replace(/^v1=/, "")))) {
return new Response("bad signature", { status: 401 }); // never process unverified payloads
}
const event = JSON.parse(raw);
if (await seen(event.event_id)) return new Response("ok", { status: 202 }); // idempotent ack
await processAsync(event); // ack fast, work async
return new Response("ok", { status: 202 });Retry sequence on failure
Duplicates are possible by design — consumers must key off event_id. Never blindly retry operations that could create duplicate side effects.
HMAC-SHA256 signatures with timestamp, secret rotation, TLS, replay protection where supported, least-privilege subscriptions, payload minimization — and delivery logs that avoid personal-data exposure.
Endpoint health, delivery success/failure, latency, retry counts, recent errors, last success and correlation IDs — with controlled replay where supported. The console is part of the design; it activates with the live event fabric.
Webhook governance: signatures verified on raw bodies, idempotent consumers required, retries/backoff/dead-letter documented, replay controlled. All payloads here are illustrative fixtures until the live event fabric ships.