Webhooks

Webhooks send an HTTP POST request to your endpoint when something changes in DUET, so your systems stay up to date without polling.

EventsCopy Anchor Link

Each event's payload is in the API reference.

Add an endpointCopy Anchor Link

1. In the DUET app, open a site, and then open Integrations.
2. Click Add endpoint.
3. Enter your endpoint's URL. It must be an https address that's reachable from the internet.
4. Choose whether to send events from every site, or from this site only.
5. Select the events to send. To receive every event, including events added later, select none.
6. Save the endpoint.
7. Copy the signing secret, and store it somewhere safe. DUET shows the secret only once.

To change, pause, or remove an endpoint later, use its menu on the Integrations page. Activity shows each delivery attempt.

Request formatCopy Anchor Link

Every request has these headers:

The body is a JSON object:

{
  "schema_version": 1,
  "id": "evt_8f14e45fceea167a5a36dedd4bea2543",
  "type": "issue.created",
  "occurred_at": "2026-05-25T14:03:11.000Z",
  "organization_id": "…",
  "project_id": "…",
  "data": {}
}

data holds the issue, work order, or alarm as it was after the change.

Verify the signatureCopy Anchor Link

Verify every request before you act on it, so you know it came from DUET and wasn't changed on the way.

The X-Duet-Signature header looks like this:

t=1716645791,v1=5257a869…,v1a=9c1f7e3b…

• t is when DUET signed the request, in Unix seconds.
• v1 is an HMAC-SHA256 signature, keyed with your endpoint's signing secret.
• v1a is an Ed25519 signature, which you verify with DUET's public keys.

Both sign the same string: the value of t, a period, and the raw request body. Verify either one.

To verify v1:

1. Read the raw request body before you parse it as JSON.
2. Build the string <t>.<raw body>.
3. Calculate its HMAC-SHA256 with your signing secret, as lowercase hex. Use the whole secret as the key, including the whsec_ prefix.
4. Compare the result with each v1 value in the header, using a constant-time comparison. If none match, reject the request.
5. If t is more than 5 minutes from your current time, reject the request.

import hashlib
import hmac
import time


def verify(raw_body: bytes, header: str, secret: str) -> bool:
    parts = [p.split("=", 1) for p in header.split(",")]
    t = next(v for k, v in parts if k == "t")
    if abs(time.time() - int(t)) > 300:
        return False
    signed = f"{t}.".encode() + raw_body
    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(expected, v) for k, v in parts if k == "v1")

To verify v1a instead, fetch DUET's public keys from https://api.enurgen.com/webhooks/jwks.json. Cache the keys for up to 5 minutes, and fetch them again when a signature doesn't verify.

Replace a signing secretCopy Anchor Link

To replace a secret, open the endpoint's menu on the Integrations page, and click Replace signing secret. The old secret keeps working for 24 hours, so you have time to update your endpoint. During that time, the header carries a v1 signature for each secret.

Respond to a requestCopy Anchor Link

Return any 2xx status within the endpoint's timeout, which is 10 seconds unless you change it. To stay within it, store the event and process it after you respond.

RetriesCopy Anchor Link

If your endpoint doesn't respond with a 2xx, DUET retries the request.

To send a failed delivery again, find it under Activity, and click Send again. It keeps its original event ID.

Handle duplicates and orderCopy Anchor Link

• Duplicates: you might receive the same event more than once. Use X-Duet-Event-Id to ignore events you've already processed.
• Order: events can arrive out of order. Keep the version of each record with the latest updated_at.
• Your own changes: changes you send to DUET through inbound sync aren't sent back to you as webhooks.

NetworkCopy Anchor Link

Webhooks come from the IP address 3.133.25.142. If your firewall allows only known addresses, add it to your allow list. We notify you before it changes.

DUET doesn't follow redirects. Give the final URL of your endpoint.