Webhooks

Receive real-time event notifications when things happen in your Renvo organization. Configure endpoints in Settings → Developers.

Event delivery

When an event occurs, we POST a JSON payload to your endpoint. Events include a unique ID, type, timestamp, and the resource that triggered it.

POST /your-webhook-endpoint HTTP/1.1
Host: yourbiz.com
Content-Type: application/json
User-Agent: Renvo-Webhooks/1.0
Renvo-Signature: t=1714944000,v1=4f9b7c8a2e1d…
Renvo-Event-Id: evt_a4d2e1c0
Renvo-Event-Type: rental.created

{
  "id": "evt_a4d2e1c0",
  "type": "rental.created",
  "created": 1714944000,
  "data": {
    "object": "rental",
    "id": "re_…",
    "customer_id": "cu_…",
    "vehicle_id": "ve_…",
    "status": "NEW"
  }
}

Verifying signatures

Every delivery is signed with HMAC-SHA256 using the secret shown when you created the webhook. The Renvo-Signature header contains a timestamp and signature pair:

Renvo-Signature: t=1714944000,v1=<hmac_sha256_hex>

To verify, compute HMAC-SHA256(secret, "{t}.{raw_body}") and constant-time compare to the v1 value.

import { createHmac, timingSafeEqual } from 'node:crypto'

export function verifyRenvoSignature(rawBody, header, secret) {
  const m = /^t=(\d+),v1=([a-f0-9]+)$/.exec(header)
  if (!m) return false
  const [, ts, sig] = m
  // Reject deliveries older than 5 minutes (replay protection)
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false
  const expected = createHmac('sha256', secret)
    .update(`${ts}.${rawBody}`)
    .digest('hex')
  return timingSafeEqual(Buffer.from(expected), Buffer.from(sig))
}

Retries

We retry failed deliveries up to 5 timeswith exponential backoff (30s, 2m, 10m, 30m, 2h). After 20 consecutive failures across all events, we auto-disable the endpoint and you'll need to re-enable it from the dashboard.

Your endpoint must respond with 2xx within 10 seconds. Anything else (or a timeout) is treated as failure.

Idempotency

Deliveries are at-least-once. The same event may be delivered more than once during a retry window. Use Renvo-Event-Id as a deduplication key.

Event types