Coding agent documentation index Fetch the complete documentation index at: https://docs.worklittle.com/docs-agent-manifest.json Use this file to discover all available pages before exploring further.

Webhook integration

Verify signatures, parse payloads, and handle retries safely in your application.

Payload shape

Each delivery is a JSON POST with an event id, type, timestamp, and data object.

{
  "id": "6f1c2a9e-…",
  "type": "candidate.application_submitted",
  "created_at": 1748948400,
  "data": { }
}

created_at is Unix seconds, not an ISO string, and is set when each attempt is sent. The id is the same on every retry of the same event. Requests carry User-Agent: worklittle-webhooks/1.0.

Respond with 2xx quickly and do heavy work asynchronously. Non-2xx responses are retried - see Delivery and retries.

Signature headers

| Header | Value |
| --- | --- |
| `Worklittle-Webhook-Id` | Event id. Use it to dedupe retries. |
| `Worklittle-Webhook-Timestamp` | Unix seconds |
| `Worklittle-Webhook-Signature` | `v1=<hex>`, an HMAC-SHA256 of `timestamp.body` keyed with your `whsec_` signing secret |

Reject requests whose timestamp is more than a few minutes old to limit replay.

Verify in Node

Read the raw body before JSON parsing, or the signature will not match.

import crypto from "node:crypto";

function verify(sigHeader, timestamp, rawBody, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");
  const received = sigHeader.replace(/^v1=/, "");
  const a = Buffer.from(expected);
  const b = Buffer.from(received);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

Job board cache invalidation

job.published, job.updated, and job.closed include these fields next to job:

| Field | Description |
| --- | --- |
| `public_job_id` | Hosted index id (`job.job_id`) |
| `slug` | Public careers slug |
| `organization.slug` | Employer board slug |
| `public_visible` | Whether the role appears on the organization homepage list |
| `accepting_applicants` | Whether apply is open |

Revalidate your /careers index and /careers/{slug} pages when these events arrive.