Integration

Push events to your systems in real time

Subscribe to Autopilot and tender events, receive signed payloads, and replay failed deliveries from the outbox.

View plans Talk to sales

LiveScale and Command

Webhooks & Events

Signed event delivery with retries and schema versioning.

Signed payloads with HMAC and timestamp

Outbox, retries, and per-endpoint delivery controls

Schema versioning for safe upgrades

How it works

What happens behind the scenes once you enable the integration.

1Create a webhook endpoint with a URL and event filters.
2Events enter the outbox and are delivered asynchronously.
3Delivery retries use backoff until max attempts.
4Failed deliveries can be replayed from the UI.

Setup checklist

Steps your admin takes to get the integration live.

Workspace -> Integrations -> Webhooks.
Add endpoint URL and select events (or all events).
Copy the generated secret and verify signatures server-side.
Tune timeout/max attempts per endpoint.

Technical reference

Endpoints and sample requests to hand to your engineering team.

Endpoints

POST /integrations/endpoints
PATCH /integrations/endpoints/{id}
POST /integrations/endpoints/{id}/rotate-secret
GET /integrations/outbox
POST /integrations/outbox/{id}/replay

Sample request

curl -X POST "https://api.tenders.indexbox.io/integrations/endpoints" \
  -H "Content-Type: application/json" \
  -b "<workspace session>" \
  -d '{"kind":"webhook","name":"Ops","url":"https://example.com/webhook","events":["autopilot.pack_ready"]}'

Sample payload

{
  "schema_version": "2025-12-19",
  "event_id": "org:autopilot.pack_ready:1700000000:abcd",
  "event_type": "autopilot.pack_ready",
  "organization_id": 123,
  "created_at": "2025-12-19T10:00:00Z",
  "payload": {
    "tender_id": "US-NYC-12345",
    "title": "City contract"
  }
}

Notes

Signature headers include X-IndexBox-Signature and X-IndexBox-Timestamp.
Schema version is sent in X-IndexBox-Schema-Version header.
Replay resets attempt counters and re-queues delivery.

FAQ

Quick answers to common integration questions.

How do I verify webhook signatures?

Use the endpoint secret to compute the HMAC and compare it with the X-IndexBox-Signature header.

What happens if my endpoint is down?

Deliveries are retried with backoff until max attempts. Failed events remain in the outbox for replay.

Can I replay missed events?

Yes. Use the outbox UI or replay endpoint to re-queue failed deliveries.

Security & compliance

Controls that keep data safe and auditable.

HMAC signatures prevent spoofed events.
Outbound allowlist blocks unsafe destinations.
Endpoint secrets can be rotated without downtime.

Back to all integrations