Events
Examples: user.created, payment.completed, affiliate.referral.converted, whitelabel.customer.created, wordpress.publish.completed.
Connect business events to your systems.
The V36 Event Hub provides scoped outbound webhook infrastructure. This guide describes the implementation interface; production delivery certification and broader public REST APIs are still in progress.
Event delivery model
Application actions emit events, scoped to system, user, affiliate or white-label ownership. Matching subscribed endpoints receive signed HTTPS POST requests through an asynchronous queue with retries and dead-letter handling.
Event → ownership scope → endpoint subscription → delivery queue → signed HTTPS POST → 2xx acknowledgement
Authentication
Each endpoint receives a private signing secret. Verify the request timestamp and X-SmartersWeb-Signature with constant-time comparison.
Delivery
Allow retries, store processed event IDs and make your receiver idempotent. Never treat delivery as exactly once.
Webhook signing
The signature is v1= followed by the hexadecimal HMAC-SHA256 of timestamp + "." + raw_request_body using your endpoint secret.
X-SmartersWeb-Event: payment.completed
X-SmartersWeb-Delivery: <unique-delivery-uuid>
X-SmartersWeb-Timestamp: <unix-time-seconds>
X-SmartersWeb-Key-Id: <key-id>
X-SmartersWeb-Signature: v1=<hmac-sha256-hex>
Require HTTPS, check timestamps for replay and never log signing secrets. Subscriber retries must be idempotent.
Provider callbacks
PayPal's receiver route is https://ai.smartersweb.com/api/webhooks/paypal.php. This is a server-to-server provider ingress endpoint, not the URL customers register for outbound delivery. Provider signatures and webhook IDs must be verified before mutating billing or commission state.
Availability
External endpoint management is restricted to authorized user, affiliate, tenant and admin controls. Public API keys, app marketplaces and SDK downloads are roadmap features, not currently available products.