Consume
Webhooks
Register a URL, receive signed events, acknowledge fast. Deliveries retry with backoff for 24 hours.
Subscribe with POST /v1/subscriptions: a URL, the oyss. event types you want (globs work: oyss.fixture.), and an optional scope filter such as {"competition": "cmp_…"}. The signing secret is returned once.
Every delivery is signed with HMAC-SHA256 over the raw body; verify the signature header before trusting a payload. Answer 2xx quickly and do the work asynchronously — a delivery that fails retries with exponential backoff for 24 hours, and every attempt is visible in the dashboard. An endpoint that stops answering entirely is disabled automatically (no successful delivery for 30+ minutes across 20+ attempts) with the reason shown on the dashboard; re-create the endpoint once it is healthy and reconcile with delta sync.
Treat webhooks as a nudge, not the ledger: on each event (or after downtime), reconcile with GET /v1/changes from your stored cursor.