Webhooks

curl -X POST -H "Authorization: Bearer YOUR_TOKEN" -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/lightyshare", "events": ["rental.requested", "message.received"]}' \
  https://www.lightyshare.com/api/token-secured/webhooks

The answer holds secret, shown only once. Up to 5 endpoints, HTTPS on a public address only.

Events

rental.requested, rental.accepted, rental.paid, rental.canceled, rental.completed, rental.modification_proposed, rental.modification_accepted, rental.modification_closed, deposit.status_changed, message.received.

Payload

Payloads only hold identifiers: read the details through the API.

{
  "id": "rental_event:881",
  "type": "rental.requested",
  "occurredAt": "2026-11-02T10:15:00+01:00",
  "data": { "rentalId": 12345 }
}

id identifies the event: the same event can arrive twice.

Check the signature

Lightyshare-Signature: t=1793700000,v1=<hex>

v1 is the HMAC SHA-256 of {t}.{raw body} with your secret. Reject a t older than 5 minutes.

Delivery

Answer with a 2xx status within 10 seconds. Failures are retried after 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours and 24 hours. After 20 consecutive failures the endpoint is turned off. Delivery happens within about a minute of the event.

GET /webhooks, DELETE /webhooks/{id}
GET /webhooks/{id}/deliveries: the last 50 deliveries

Getting Started

Core Resources

Examples

Events

Payload

Check the signature

Delivery

​Events

​Payload

​Check the signature

​Delivery

Events

Payload

Check the signature

Delivery