> ## Documentation Index
> Fetch the complete documentation index at: https://trailblazer.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# NaijaTaste API webhooks for event notifications

> Planned NaijaTaste webhook events, how to register an endpoint, HMAC-SHA256 signature verification, and the retry schedule for failed deliveries.

Webhooks let your system receive automatic notifications when specific events happen on the platform.

<Note>
  Webhooks are on the roadmap. The current public API is request-response only. This page documents the intended behaviour when the webhook tier ships.
</Note>

## Planned events

| Event                    | When it fires                                            |
| ------------------------ | -------------------------------------------------------- |
| `cache.invalidated`      | A cached restaurant query is invalidated and refreshed   |
| `places.updated`         | Google Places data for a tracked location is updated     |
| `api.rate_limit_warning` | Your integration is approaching the rate limit threshold |

## Registering a webhook

When the webhook tier ships:

```bash theme={null}
curl -X POST https://naijataste-api.onrender.com/webhooks \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://yourapp.com/webhooks/naijataste",
    "events": ["cache.invalidated", "places.updated"]
  }'
```

## Verifying webhook signatures

All payloads will be signed with HMAC-SHA256. Always verify before processing:

```javascript theme={null}
const crypto = require('crypto');

function verifyWebhook(payload, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}
```

<Warning>
  Never trust unverified webhook payloads. Always verify the signature first.
</Warning>

## Retry behaviour

Failed deliveries are retried with exponential backoff:

| Attempt | Delay      |
| ------- | ---------- |
| 1       | Immediate  |
| 2       | 30 seconds |
| 3       | 5 minutes  |
| 4       | 1 hour     |
| 5       | 24 hours   |

After five failed attempts, the event is marked undeliverable.

<Card title="Rate limits" icon="gauge" href="/developers/rate-limits">
  How rate limits interact with webhook delivery and API access.
</Card>