Webhooks
Signed, retried HTTP callbacks for business events — invoices, e-Factura status, orders, contracts and more.
Subscribe
curl -X POST https://api.brivio.ro/v1/webhooks \
-H "Authorization: Bearer brivio_sk_live_..." \
-H "Content-Type: application/json" \
-d '{
"url": "https://example.com/hooks/brivio",
"events": ["invoice.created", "invoice.paid", "efactura.validated", "efactura.rejected"]
}'The response includes a secret (shown once) used to sign every delivery. List available event types at GET /v1/webhooks/events.
Verify signatures
Each delivery is signed with HMAC-SHA256 over the raw request body, sent in the X-Brivio-Signatureheader. Reject anything that doesn't match:
import { createHmac, timingSafeEqual } from "node:crypto";
function verify(rawBody: string, signature: string, secret: string): boolean {
const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
return timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}Delivery & retries
Deliveries time out after 10 seconds. Failures retry up to 5 times with exponential backoff; exhausted deliveries are marked dead. Endpoints that keep failing are automatically disabled and can be re-enabled from the dashboard. Redeliver any delivery with POST /v1/webhooks/:id/deliveries/:deliveryId/redeliver.
All events
addendum.created affiliate.commission.accrued affiliate.commission.available affiliate.enrolled affiliate.payout.paid affiliate.referral.created article.created article.deleted article.updated booking.cancelled booking.confirmed change_request.approved change_request.created contact.created contact.deleted contact.updated contract.created contract.deleted contract.signed contract.suspended contract.updated document.created document.deleted document.updated efactura.rejected efactura.submitted efactura.validated expense.created expense.deleted expense.updated fixed_asset.created fixed_asset.disposed invoice.cancelled invoice.created invoice.deleted invoice.overdue invoice.paid invoice.payment_recorded invoice.sent invoice.updated marketing.campaign.sent milestone.accepted milestone.delivered milestone.rejected order.created order.paid project.created project.deleted project.updated restaurant.order.placed stock.below_minimum trust.batch.completed trust.batch.failed trust.provider.health_changed trust.signature.completed trust.signature.failed trust.timestamp.completed trust.validation.completed
Payload shape
{
"id": "evt_...", // unique delivery id (X-Brivio-Delivery)
"type": "efactura.validated",
"created_at": "2026-08-01T10:00:00Z",
"data": { "invoice_id": "...", "efactura_id": "...", "stare": "ok" }
}Deliveries are at-least-once — deduplicate on the delivery id if your handler isn't idempotent.