Build an app

Webhooks

When an app is installed on a workspace and has a webhook URL, Invoist POSTs signed JSON events to that URL.

Events

Type	When
`document.created`	A document was uploaded (API or dashboard).
`extraction.completed`	Extraction finished successfully.
`extraction.failed`	Extraction failed.
`review_item.created`	An item was added to the review queue.
`review_item.resolved`	A review item was resolved.

Payload

JSON

12345678910{
  "id": "01a0…",
  "type": "extraction.completed",
  "created_at": "2026-08-20T09:14:11Z",
  "data": {
    "document_id": "…",
    "extraction_id": "…",
    "status": "done"
  }
}

Signature

Header X-Invoist-Signature: t=TIMESTAMP,v1=HMAC_HEX where HMAC-SHA256 is computed over timestamp + "." + raw_body with your webhook secret (shown once when you create or rotate the secret).

Verify (Node)

JavaScript

1234567891011121314151617const crypto = require("crypto");

function verify(header, body, secret) {
  // header: t=1710000000,v1=hex
  const parts = Object.fromEntries(
    header.split(",").map((p) => p.trim().split("="))
  );
  const signed = parts.t + "." + body;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(signed)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(parts.v1)
  );
}

Retries

Failed deliveries (network error or non-2xx) retry up to 3 times with exponential backoff. Use id as an idempotency key.

Headers

X-Invoist-Event — event type
X-Invoist-Delivery — delivery id
X-Invoist-Signature — timestamped HMAC