Outbound Webhooks

The Settings → Outbound Webhooks page is the customer-facing UI for managing the Partner API's webhook subscriptions. Anything you can do here you can also do via the Partner API — the UI and the API write to the same underlying webhook_subscriptions table. Admin-only.

What you can do here

Create a subscription

Click Create Subscription and configure:

• Target URL — must be HTTPS. Aura runs an SSRF guard (no localhost, no private IPs, no link-local) at create-time and at every delivery to defend against DNS rebinding.
• Event filter — pick which events trigger delivery (or all). See Webhooks → Event Types for the canonical list.
• Description — internal label so you remember what each subscription does.

When you save, Aura generates a signing secret. The secret is shown exactly once — copy it now or you'll need to rotate later.

View delivery logs

Click any subscription to see recent delivery attempts:

• HTTP status code returned by your endpoint
• Response time
• Error message if delivery failed
• Number of attempts (retries on failure)

This is the same data accessible via GET /v1/webhooks/deliveries?subscription_id=... on the Partner API.

Rotate the signing secret

Settings → Rotate Secret on a subscription:

• Generates a new HMAC signing secret
• For 24 hours, deliveries include both the new and old signature (Stripe-style two-segment header)
• After 24h, only the new secret signs deliveries
• This lets you roll the secret on your side without dropping any payloads

Delete a subscription

Stops future deliveries immediately. Existing delivery logs are kept for audit.

What this isn't

• Inbound webhooks (Stripe, Nylas, Clerk events arriving at Aura) — those are wired up in the integrations layer, not here.
• Zapier triggers — different event set with a richer surface; configure Zaps on zapier.com. See Zapier.
• The schema reference — Settings shows your subscriptions and their delivery history. For event names, payload shapes, and signature verification, see Webhooks.

Security

• HTTPS only. Aura refuses http:// URLs at create time and at delivery time.
• SSRF guard. Targets in private IP ranges, link-local space, or cloud metadata ranges (169.254.169.254) are rejected. The check re-runs on every delivery to catch DNS rebinding.
• Signing. Every delivery carries X-Aura-Signature-V1: t=<unix_ms>,v1=<sha256_hex>. The signed string is ${timestamp}.${rawBody} — verifying with the body alone is insufficient. See Payload Reference → Verifying signatures.
• Replay protection. Reject deliveries whose t= value drifts more than 5 minutes from your server clock.
• Admin-only. Subscription CRUD requires admin scope on API keys, and Admin role in the UI. Every action emits an audit-trail entry.

Retry behavior

Failed deliveries (any non-2xx response, or a network error) are retried:

• 3 retries total
• Exponential backoff: 1s, 5s, 15s
• 10-second per-request timeout

After all retries fail, the subscription stays active — Aura doesn't auto-pause subscriptions on failure. If your endpoint is consistently failing, the delivery logs surface that and you can rotate, fix, or delete.

Related

• Webhooks → Overview — concept and verification flow
• Webhooks → Event Types — every event you can subscribe to
• Webhooks → Payload Reference — what data looks like per event
• API Keys — needed for managing subscriptions programmatically (requires admin scope)