Webhooks

Subscribing to events

Webhooks are registered in Settings → Developers → Webhooks. Pick the events you care about and give a destination URL.

Event types

• memory.created — a new memory was captured.
• memory.updated — an existing memory was edited.
• memory.deleted — a memory was removed.
• collection.updated — membership changes.

Payload shape

Each webhook is a POST with a JSON body:

{
  "event": "memory.created",
  "deliveredAt": "2026-08-08T12:00:00Z",
  "data": {
    "memory": {
      "id": "mem_01HXYZ...",
      "content": "Decided to use JWT for auth.",
      "source": "claude",
      "tags": ["auth", "decision"],
      "collection": "project-atlas"
    }
  },
  "attempt": 1
}

Verifying the webhook

Every webhook is signed with HMAC-SHA256. Compare the signature in the X-OmegaVault-Signature header against your webhook secret:

import crypto from 'crypto';

const expected = crypto
  .createHmac('sha256', process.env.OV_WEBHOOK_SECRET)
  .update(rawBody)
  .digest('hex');

if (expected !== req.headers['x-omegavault-signature']) {
  return res.status(401).send('invalid signature');
}

Retries

OmegaVault retries failed deliveries with exponential backoff for up to 24 hours. A delivery is considered failed when your endpoint returns a non-2xx status or times out (30s). After 24 hours the webhook is marked failed and surfaced in the webhook log.