Webhooks

Register an approved HTTPS receiver with POST /api/v1/webhook-subscriptions and the webhook-subscriptions.write scope. Available event types depend on the agreed integration profile. Notifications carry event and resource identifiers and metadata.

Compute HMAC-SHA256 over X-Elynext-Webhook-Timestamp, a period and the raw request body. Compare the result in constant time against the v1= digest in X-Elynext-Webhook-Signature. Reject timestamps outside the acceptance window documented in your integration settings. Each retry carries a fresh signature timestamp and the same event ID.

Events contain identifiers and metadata, not patient details or resource snapshots. Retrieve the current resource through an authorized API request when needed. Do not assume historical replay, intermediate-state history or exactly-once delivery. Additional clinical event types require explicit authorization and confirmation of the workflows that emit them.

Return 2xx after durable acceptance, deduplicate by eventId and handle out-of-order delivery. The API defaults to three delivery attempts in total, with retries scheduled 60 and 120 seconds after the preceding failures. Environment settings can override these defaults. Before enabling delivery, request written confirmation from your onboarding contact of the receiver timestamp window, effective retry schedule and reconciliation procedure for your environment.