← Developer docs

Outbound webhooks

Subscribe to events from Vigilimate. Every delivery is HTTPS POST with a Stripe-style HMAC signature in the MTGA-Signature header. Retry policy: exponential backoff over 24h, max 6 attempts.

Subscribing

Use the admin UI at /admin/settings/api, or call the API:

curl -X POST https://learn.mediatech.group/api/v1/webhooks \
  -H "Authorization: Bearer mtga_sk_..." \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://partner.example.com/hooks/mtga",
    "events": ["program.completed", "award.issued"]
  }'

Delivery shape

POST /hooks/mtga
Content-Type: application/json
MTGA-Event: program.completed
MTGA-Signature: t=1737394800,v1=2c1f...

{
  "event": "program.completed",
  "timestamp": 1737394800,
  "data": {
    "user_id": "...",
    "program_id": "...",
    "completed_at": "...",
    "issuance_ids": ["..."]
  }
}

Verifying the signature

import { verifyWebhookSignature } from "@mtga/sdk";

const ok = verifyWebhookSignature({
  body: rawRequestBody,
  header: request.headers.get("mtga-signature"),
  secret: process.env.MTGA_WEBHOOK_SECRET,
});

Events