Events

• • report.created
• • report.updated

Delivery headers

• • x-feedbackr-event: event name
• • x-feedbackr-delivery: delivery/job id
• • x-feedbackr-timestamp: ISO timestamp
• • x-feedbackr-signature: sha256=… (only if a secret is configured)

Payload shape

The payload includes the event, a delivery id, and a data object containing project and report fields.

{
  "id": "delivery-id",
  "event": "report.created",
  "created_at": "2026-01-29T00:00:00.000Z",
  "data": {
    "project": { "id": "...", "slug": "default", "name": "Default" },
    "report": {
      "id": "...",
      "project_id": "...",
      "env": "prod",
      "type": "bug",
      "status": "new",
      "message": "…",
      "url": "https://…",
      "github_issue_url": null,
      "duplicate_of_report_id": null,
      "created_at": "…",
      "updated_at": "…"
    }
  },
  "changes": null
}

Signature verification

If you configure a secret, compute HMAC SHA-256 of the raw request body and compare it to the header value.

import { createHmac, timingSafeEqual } from "crypto";

function verify(body: Buffer, header: string, secret: string) {
  const expected = "sha256=" + createHmac("sha256", secret).update(body).digest("hex");
  return timingSafeEqual(Buffer.from(expected), Buffer.from(header));
}