Webhooks

Available events

• ticket.created — a new ticket was opened
• ticket.escalated — assigned to another team member
• ticket.resolved — marked resolved, awaiting verification
• ticket.reopened — the user reported it still broken
• incident.detected — clustered incident created

Payload

{
  "id": "evt_123",
  "type": "ticket.resolved",
  "created_at": "2026-06-07T10:00:00Z",
  "data": { "ticket_id": "tkt_123", "agent_id": "ag_9" }
}

Verify signatures

Each delivery includes an X-SupportFlow-Signature header. Compute an HMAC-SHA256 of the raw body using your signing secret and compare.

const expected = crypto
  .createHmac("sha256", process.env.SF_WEBHOOK_SECRET)
  .update(rawBody)
  .digest("hex");
if (signature !== expected) return res.status(401).end();