# Webhooks

Register HTTPS endpoints and receive HMAC-SHA256 signed events.

**POST** `https://api.oneover.com/functions/v1/api-v1-webhooks`

**Scope:** `webhooks`

```json
{
  "url": "https://example.com/hooks/oneover",
  "events": ["job.completed", "job.failed", "credits.low"]
}
```

## Events that are sent

| Event | When |
|-------|------|
| `job.completed` | A video job finishes successfully |
| `job.failed` | A video job fails |
| `credits.low` | A charge drops the org balance from at least 100 credits to under 100 |

Images and audio finish inside the HTTP response. They do not emit `job.completed` or `job.failed`.

The create response includes `secret` once. Verify:

`X-OneOver-Signature: sha256=<hex>` over the raw JSON body.

Retries use 30s / 2m / 10m / 1h / 6h backoff via `api-webhook-worker`.

Disable an endpoint with `{ "action": "disable", "endpoint_id": "<id>" }`. `GET` lists endpoints for the org.