Webhooks

Pointset pushes events to your webhook URL whenever entities change. Configure your endpoint via the webhook API, and Pointset will POST a signed JSON payload for each event.

Events

Event	When it fires
`entity.discovered`	A new entity matching your subscription is found
`entity.updated`	One or more of your subscribed fields changed
`entity.removed`	An entity no longer appears in source data

Each delivery contains up to 25 entities. Large batches are split into multiple requests.

Verifying signatures

Every request includes an X-Pointset-Signature header:

X-Pointset-Signature: sha256=<hex>

The signature is HMAC-SHA256 of the raw request body, keyed with your webhook secret. Verify it before processing:

async function verifySignature(secret: string, body: string, header: string): Promise<boolean> {
  const encoder = new TextEncoder()
  const key = await crypto.subtle.importKey(
    'raw', encoder.encode(secret),
    { name: 'HMAC', hash: 'SHA-256' },
    false, ['verify']
  )
  const expected = header.replace('sha256=', '')
  const sig = await crypto.subtle.sign('HMAC', key, encoder.encode(body))
  const actual = Array.from(new Uint8Array(sig))
    .map(b => b.toString(16).padStart(2, '0')).join('')
  return actual === expected
}

Your secret is returned when you first configure the webhook, or when you rotate it. Store it securely — it is not shown again.

Retries

If your endpoint returns a non-2xx response (or times out), Pointset retries with exponential backoff:

Attempt	Delay
1	30s
2	60s
3	120s
…	doubles each time, capped at 24h

After 10 failed attempts the delivery is marked failed and not retried. Return a 2xx as quickly as possible — process events asynchronously if needed.

The `fields` object

Each entity in the payload includes only the fields your subscription requested, not the full entity record. If you need additional fields, update your subscription.

Overview

Concepts

Subscriptions

Webhook

Webhook Events

Entities

Fields

Events

Verifying signatures

Retries

The `fields` object

​Events

​Verifying signatures

​Retries

​The fields object

Events

Verifying signatures

Retries

The `fields` object