# Webhooks

Growth tenants create endpoints under **Settings → Automations**. You choose the event types. DoorOps queues delivery, retries on failure, and keeps a delivery history.

## Headers

Every request includes:

| Header | Meaning |
| --- | --- |
| `X-DoorOps-Event` | Event name |
| `X-DoorOps-Delivery` | Stable delivery id. De-duplicate on this |
| `X-DoorOps-Signature` | HMAC of the raw body with your endpoint secret |

Verify the signature before you trust the payload. Destinations must be HTTPS and public. DoorOps will not post to private networks or metadata hosts.

## Behaviour

- Payloads are encrypted at rest in DoorOps
- Core DoorOps actions do not wait on your receiver
- Failed deliveries stay visible; you can resend
- Event and resource types are an allow-list, not "everything in the database"

Use webhooks together with the [REST API](/docs/developers/api) when you need to pull extra fields after the event.

Inbound provider webhooks (for example Joblogic events for already-imported jobs) are a separate, provider-configured callback. Those refresh exact mapped work orders. They are not a general inbound integration bus.