Webhooks

Webhooks tell your systems about events as they happen: a meeting ended, a summary is ready, a document finished processing. Rydhm sends each event as a JSON POST to the endpoints you choose.

Deliveries follow the Standard Webhooks format, so any Standard Webhooks or Svix library can verify them.

Add an endpoint

Only workspace admins manage webhooks, in the app. API keys can’t create or change endpoints.

A workspace can have up to 10 endpoints. To check an endpoint, open it and choose Send test event. Rydhm sends a webhook.test event to that endpoint only, even if it doesn’t subscribe to it.

Events

Every meeting that reaches a final state sends exactly one of meeting.ended or meeting.join_failed.

The payload

Every delivery has the same envelope:

{
  "id": "evt_01JBX7Q8M4N2P6R9S3T5V7W9YA",
  "type": "meeting.summary.ready",
  "created_at": "2026-11-04T10:48:20.000Z",
  "workspace_id": "6f1c2a9e-3b7d-4c55-9a0e-1d2f3a4b5c6d",
  "data": {
    "meeting": {
      "id": "9d4e5f60-1a2b-4c3d-8e9f-0a1b2c3d4e5f",
      "title": "Weekly pipeline review",
      "ended_at": "2026-11-04T10:47:40.000Z"
    },
    "expert_id": "2b8e4d10-7c3a-4f9b-8e21-5a6b7c8d9e0f",
    "expert": { "id": "2b8e4d10-7c3a-4f9b-8e21-5a6b7c8d9e0f", "name": "Ava" },
    "summary": {
      "snippet": "The team agreed to move the Acme renewal to Q1 and to send pricing by Friday.",
      "key_points": 6,
      "action_items": 3,
      "decisions": 2,
      "topics": ["renewals", "pricing"],
      "generated_at": "2026-11-04T10:48:20.000Z"
    },
    "links": {
      "app": "https://app.rydhm.ai/conversations?id=9d4e5f60-1a2b-4c3d-8e9f-0a1b2c3d4e5f",
      "api": "https://api.rydhm.ai/v1/meetings/9d4e5f60-1a2b-4c3d-8e9f-0a1b2c3d4e5f"
    }
  }
}

What data contains

Payloads carry ids, names, statuses, timestamps, counts and links. They never carry a transcript, a message, an expert’s instructions, tool arguments or anything secret. To get the full record, call the API at data.links.api with a key that has the right scope. data.links.app opens the same record in the app.

Most events carry expert_id and expert (id and name).

A payload larger than 256 KB is replaced by a stub with truncated: true, the expert_id and the links. Fetch the record through links.api instead.

Headers

Every delivery is a POST with these headers:

Verify the signature

Check every delivery before you trust it. The signature is an HMAC-SHA256, computed like this:

1. Take the signing secret, remove the whsec_ prefix and base64-decode the rest. That is the HMAC key.
2. Build the signed content: {webhook-id}.{webhook-timestamp}.{raw body}.
3. Compute HMAC-SHA256 of the content with the key, and base64-encode it.
4. Compare it with each v1, entry in webhook-signature. Any match is valid.
5. Reject the request if webhook-timestamp is more than 5 minutes (300 seconds) from your clock. This stops replays.

import { createHmac, timingSafeEqual } from "node:crypto";
const TOLERANCE_SECONDS = 300;
export function verifyRydhmWebhook(
  secret: string, // "whsec_…"
  headers: Record<string, string | string[] | undefined>,
  rawBody: string | Buffer, // the exact bytes received
): boolean {
  const id = String(headers["webhook-id"] ?? "");
  const timestamp = String(headers["webhook-timestamp"] ?? "");
  const signatures = String(headers["webhook-signature"] ?? "");
  if (!id || !timestamp || !signatures) return false;
  const sentAt = Number(timestamp);
  if (!Number.isFinite(sentAt) || Math.abs(Date.now() / 1000 - sentAt) > TOLERANCE_SECONDS) {
    return false;
  }
  const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");
  const expected = createHmac("sha256", key)
    .update(`${id}.${timestamp}.`)
    .update(rawBody)
    .digest();
  // Two signatures arrive during a secret rotation: any match is enough.
  return signatures.split(" ").some((entry) => {
    const [version, signature] = entry.split(",");
    if (version !== "v1" || !signature) return false;
    const given = Buffer.from(signature, "base64");
    return given.length === expected.length && timingSafeEqual(given, expected);
  });
}

import express from "express";
import { verifyRydhmWebhook } from "./verify";
const app = express();
app.post("/webhooks/rydhm", express.raw({ type: "application/json" }), (req, res) => {
  if (!verifyRydhmWebhook(process.env.RYDHM_WEBHOOK_SECRET!, req.headers, req.body)) {
    return res.status(400).send("Invalid signature");
  }
  const event = JSON.parse(req.body.toString("utf8"));
  // Dedupe on event.id, queue the work, and answer quickly.
  res.sendStatus(204);
});

The same scheme signs the requests your experts send to your custom tools, with the workspace’s own secret under Developers → Webhooks → Tool call signing. The same code verifies them. See Tools.

Respond quickly

Answer with any 2xx status within 10 seconds. Do the real work in a background job.

• A 2xx marks the delivery delivered.
• A redirect (3xx) is a failure: redirects are not followed.
• 410 Gone tells Rydhm to stop. The endpoint is disabled at once.
• Anything else, a timeout, or a connection error is a failure and is retried.

Retries

The first attempt is immediate. After a failure, Rydhm retries on this schedule:

That is 8 attempts over about two days. Each wait varies by up to 10% so retries don’t arrive in bursts. After the last attempt, the delivery is marked dead.

Retries carry the same webhook-id, so dedupe on it. Deliveries can arrive out of order; use created_at to order events.

Disabled endpoints

An endpoint that fails 15 or more times in a row, over at least 24 hours, is disabled automatically. Workspace admins get an email and a notification in the app, and an alert opens under Developers → Alerts.

Events that happen while an endpoint is disabled are not sent to it. Fix the endpoint, then open it in Developers → Webhooks and choose Enable.

The delivery log

Open an endpoint in Developers → Webhooks to see its deliveries: status, attempt number, your endpoint’s response status, and the time. Open a delivery to see the request body, the first 2 KB of your response, and any error.

From a delivery, Resend sends the same event again, with the same webhook-id.

Deliveries and events are kept for 30 days.

Rotate the signing secret

Open the endpoint and, under Signing secret, choose Rotate. For 24 hours the old secret keeps signing too: each delivery carries two signatures, one per secret. Deploy the new secret within that window. The verification code above accepts either.

Reveal shows the current secret again if you need it.