Each batch of new items is one POST, JSON, with object monitor_event and type new_items. items are the same objects the watched endpoint returns. Send a signed test any time with send a test event.
Headers on every delivery:
| Header | Meaning |
|---|---|
SocialScrape-Event-Id | The event id. The same id is not a new event. |
SocialScrape-Signature | t=<unix seconds>,v1=<hex HMAC-SHA256> |
User-Agent | SocialScrape-Webhooks/1 |
Verify before you trust the body. The signed string is the timestamp, a dot, then the raw request body exactly as received. The key is the whsec_... secret from when the monitor was created. Compute HMAC-SHA256, hex encode, and compare to v1 in constant time. Reject a timestamp older than 5 minutes. Do not re-serialise parsed JSON and sign that.
Answer with any 2xx within 10 seconds. The body is not read, and redirects are not followed. Anything else is retried, 6 attempts in all: immediately, then 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours after the previous attempt. A 410 Gone is a dead letter immediately. The event stays in the delivery log, and redeliver starts a fresh chain.
Respond quickly, queue the work, and drop duplicates on the event id.
Code for Python and Node is in the guide. Full detail: Monitors and webhooks.