Skip to main content
WEBHOOK

Authorizations

TeraRx-Signature
string
header
required

Not a credential you send. TeraRx signs every webhook delivery with your webhook secret; verify TeraRx-Signature as described in "Webhooks and signatures".

Headers

TeraRx-Timestamp
string
required

Unix time in seconds when this delivery attempt was signed. Reject deliveries more than 5 minutes old.

Pattern: ^[0-9]{10}$
TeraRx-Signature
string
required

v1=<hex> where hex is HMAC-SHA256 over <TeraRx-Timestamp>.<raw body> with your webhook secret. During a secret rotation it carries two signatures, v1=<new>,v1=<old>; accept the delivery if any one matches.

Pattern: ^v1=[0-9a-f]{64}(,v1=[0-9a-f]{64})*$
TeraRx-Event-Id
string<uuid>
required

The event id, the same as id in the body. Retries of one event carry the same id; store it and ignore repeats.

Body

application/json
id
string<uuid>
required

Unique per event; the same on every retry. Dedupe on it.

Example:

"0190f5d8-4b2d-7e6f-8a21-c2d3e4f5a6b7"

type
enum<string>
required
Available options:
enrollment.created,
enrollment.stage_changed,
enrollment.paused,
enrollment.resumed,
enrollment.cancelled,
care_team.assigned,
care_team.changed,
care_team.capacity_warning,
care_team.feedback_due,
form.requested,
onboarding.completed,
protocol.published,
protocol.updated,
message.created,
clinical.flag_raised,
clinical.flag_redelivered,
clinical.flag_acknowledged,
clinical.flag_resolved,
patient.disengaged,
patient.milestone_reached,
reminder.due,
data_request.completed
Allowed value: "care_team.feedback_due"
Example:

"enrollment.created"

created_at
string<date-time>
required

ISO 8601 in UTC.

Example:

"2026-10-26T14:05:00Z"

tenant_id
string<uuid>
required

Your tenant.

Example:

"a0000000-0000-4000-8000-000000000002"

data
object
required

Response

2XX

Any 2xx within 10 seconds acknowledges the delivery; the body is ignored. Anything else (or no answer in time) is a failed attempt and is retried with backoff for 24 hours.