DMSI Webhooks sends a consistent set of HTTP headers with every delivery.
Standard Headers #
| Header | Value | Description |
|---|---|---|
Content-Type | application/json | Payload format |
User-Agent | DMSI-Webhooks/1.0 | Identifies the sender |
DMSI Signature Headers #
| Header | Example Value | Description |
|---|---|---|
X-DMSI-Signature | sha256=abc123... | HMAC-SHA256 signature for verification |
X-DMSI-Timestamp | 1711195200 | Unix timestamp of the delivery |
X-DMSI-Webhook-ID | whk_1a2b3c... | Unique delivery ID |
X-DMSI-Event | license.created | The event name |
Custom Headers #
If an endpoint is configured with custom headers, those are included on every delivery in addition to the standard headers:
Authorization: Bearer my_internal_token
X-Source: dmsi-webhooks
Custom headers are configured per endpoint. See Endpoint Settings Reference.
Dual-Signature Header (During Rotation) #
During a key rotation window (up to 24 hours after rotating a secret), X-DMSI-Signature contains both the new and old signatures separated by , :
X-DMSI-Signature: sha256=<new_sig>, sha256=<old_sig>Accept either signature during this window. See Signing Secret Rotation.
Related Topics #
- Payload Envelope
- Signature Verification
- Signing Secret Rotation