curl --request POST \
--url https://api.tilta.io/v1/webhooks/{type}/signature_key \
--header 'Authorization: Bearer <token>'const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.tilta.io/v1/webhooks/{type}/signature_key', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.tilta.io/v1/webhooks/{type}/signature_key"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.tilta.io/v1/webhooks/{type}/signature_key",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}{
"destination_url": "<string>",
"type": "FACILITY.CREATION.ACCEPTED",
"signature_key": "<string>",
"created_at": 1582896122,
"updated_at": 1582896122
}{
"code": "BAD_REQUEST",
"error": "Request validation failed. 1 issue found.",
"issues": [
{
"code": "INVALID_TYPE",
"path": "body.registered_at",
"message": "Invalid type"
}
]
}{
"error": "Unauthorized",
"code": "UNAUTHORIZED"
}Rotate the signature key
Rotate the HMAC signing key for a webhook subscription. The new key is returned once – store it immediately in a secure secret manager.
curl --request POST \
--url https://api.tilta.io/v1/webhooks/{type}/signature_key \
--header 'Authorization: Bearer <token>'const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.tilta.io/v1/webhooks/{type}/signature_key', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.tilta.io/v1/webhooks/{type}/signature_key"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.tilta.io/v1/webhooks/{type}/signature_key",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}{
"destination_url": "<string>",
"type": "FACILITY.CREATION.ACCEPTED",
"signature_key": "<string>",
"created_at": 1582896122,
"updated_at": 1582896122
}{
"code": "BAD_REQUEST",
"error": "Request validation failed. 1 issue found.",
"issues": [
{
"code": "INVALID_TYPE",
"path": "body.registered_at",
"message": "Invalid type"
}
]
}{
"error": "Unauthorized",
"code": "UNAUTHORIZED"
}signature_key that Tilta uses to sign outgoing event payloads. Rotating this key invalidates the previous key and replaces it with a newly generated secret. The new signature_key is included in the response body exactly once – Tilta never stores or re-exposes it. You must update your webhook handler to use the new key immediately after rotation, otherwise signature verification will fail and you will reject legitimate events from Tilta.
signature_key is returned only in this response. Once you close or discard it, it is gone permanently. Store it
immediately in a secure secret manager such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, or HashiCorp Vault.
Never log this value or commit it to source control.Zero-downtime rotation procedure
Follow these steps to rotate your signature key without dropping any valid webhook deliveries:Initiate the rotation
signature_key from the response immediately.Store the new key alongside the old key
Deploy the updated handler
Remove the old key
Authorizations
Your Tilta API key, sent as Bearer <key>.
Path Parameters
The webhook's type. Supports the hierarchical dot-notation taxonomy; subscribing to a parent (e.g. FACILITY) implicitly subscribes to every descendant event (e.g. FACILITY.CREATION.ACCEPTED). Other valid values include ORDER.CONFIRMED and INVOICE.DUE.
BUYER, BUYER.CREATED, BUYER.UPDATED, FACILITY, FACILITY.CREATION, FACILITY.CREATION.ACCEPTED, FACILITY.CREATION.IN_REVIEW, FACILITY.CREATION.REJECTED, FACILITY.EXPIRED, FACILITY.FROZEN, FACILITY.INCREASE, FACILITY.INCREASE.ACCEPTED, FACILITY.INCREASE.IN_REVIEW, FACILITY.INCREASE.REJECTED, FACILITY.RENEWAL, FACILITY.RENEWAL.ACCEPTED, FACILITY.RENEWAL.IN_REVIEW, FACILITY.RENEWAL.REJECTED, FACILITY.UNFROZEN, INVOICE, INVOICE.CLOSED, INVOICE.CREATED, INVOICE.DUE, INVOICE.FILE, INVOICE.FILE.CREATED, INVOICE.FILE.DELETED, INVOICE.FILE.REPLACED, INVOICE.FINANCING, INVOICE.FINANCING.PAID_OUT, ORDER, ORDER.CANCELLED, ORDER.CLOSED, ORDER.CONFIRMED, ORDER.DISBURSED, ORDER.EXPIRED "FACILITY.CREATION.ACCEPTED"
Response
Where the webhook should be sent to. This must be an endpoint that handles POST requests.
The webhook's type. Supports the hierarchical dot-notation taxonomy; subscribing to a parent (e.g. FACILITY) implicitly subscribes to every descendant event (e.g. FACILITY.CREATION.ACCEPTED). Other valid values include ORDER.CONFIRMED and INVOICE.DUE.
BUYER, BUYER.CREATED, BUYER.UPDATED, FACILITY, FACILITY.CREATION, FACILITY.CREATION.ACCEPTED, FACILITY.CREATION.IN_REVIEW, FACILITY.CREATION.REJECTED, FACILITY.EXPIRED, FACILITY.FROZEN, FACILITY.INCREASE, FACILITY.INCREASE.ACCEPTED, FACILITY.INCREASE.IN_REVIEW, FACILITY.INCREASE.REJECTED, FACILITY.RENEWAL, FACILITY.RENEWAL.ACCEPTED, FACILITY.RENEWAL.IN_REVIEW, FACILITY.RENEWAL.REJECTED, FACILITY.UNFROZEN, INVOICE, INVOICE.CLOSED, INVOICE.CREATED, INVOICE.DUE, INVOICE.FILE, INVOICE.FILE.CREATED, INVOICE.FILE.DELETED, INVOICE.FILE.REPLACED, INVOICE.FINANCING, INVOICE.FINANCING.PAID_OUT, ORDER, ORDER.CANCELLED, ORDER.CLOSED, ORDER.CONFIRMED, ORDER.DISBURSED, ORDER.EXPIRED "FACILITY.CREATION.ACCEPTED"
Timestamp indicating when the webhook was created (unix time in seconds).
1582896122
Timestamp indicating the last time the webhook was updated (unix time in seconds).
1582896122