Webhooks

Requidex webhooks provide push-based notifications for near real-time integration workflows.

Webhooks can be scoped to a hiring company or an agency. requisition_created and requisition_approved are company-only events. requisition_received is agency-only and is sent when a requisition is released to that agency manually, after final approval, or by a scheduled tier transition. Merely selecting an agency on a draft or internally pending requisition does not send an event. Assignment and timesheet events are available in both scopes, with agency delivery limited to work supplied by that agency. Requisition cancellation and filled events are available to company webhooks and to relevant agencies that received, responded to, or supplied the requisition, as applicable. Worker submitted is a company-only event. Worker rejected and assigned events are delivered only to the affected worker's agency when the webhook is agency-scoped.

Set Up and Manage Webhooks

Webhooks are configured in the Requidex application. Open the relevant hiring company or agency, select Integrations, and then open the Webhooks tab. Company webhooks are available to users who can manage that company's integrations. For agencies, agency webhook access must be enabled before the Integrations section is available to agency administrators.

To create a webhook, choose New Webhook, enter its name and receiving endpoint URL, select the event types, and save it. You can also add a description or custom headers and choose whether the webhook is active immediately. Requidex generates the signing secret automatically; store it securely and use it to verify delivery signatures.

Each webhook belongs to exactly one hiring company or agency. From the Webhooks tab you can edit or activate/deactivate it, change its subscribed events, send a test event, inspect or export delivery logs, reveal the signing secret, or delete the webhook. Agency webhook delivery remains restricted to requisitions and workers relevant to that agency.

Subscription Availability

Category	Company webhooks	Agency webhooks
Requisitions	All except Requisition received	Received, cancelled, filled, worker rejected, and assigned; limited to relevant agencies
Assignments and Timesheets	Yes	Only records supplied by that agency
Expenses	Yes	Only that agency's expenses
Invoices and Credit Notes	Yes	Only that agency's records; excludes MSP-to-client records
Purchase Orders	Yes	No
Trades and Rates	Yes	No

Purchase order endpoints reject agency-scoped API keys. Trade and rate events cover company configuration, including shared, tier, project, and agency-specific rate cards, so these webhook subscriptions are company-only. Agency access to individual trade/rate API records does not grant access to these webhook events.

These restrictions apply when creating or editing subscriptions, sending test events, and delivering live events. Existing agency subscriptions to company-only events no longer receive them; edit the webhook to remove those events.

Supported Domain

Webhooks are available for requisitions, assignments, timesheets, expenses, invoices, credit notes, purchase orders, trades, and rates.

Event Types

• requisition_created
• requisition_approved
• requisition_received
• requisition_cancelled
• requisition_filled
• requisition_worker_submitted
• requisition_worker_rejected
• requisition_assigned
• assignment_created
• assignment_confirmed
• assignment_cancelled
• assignment_reinstated
• assignment_ended
• assignment_dates_updated
• assignment_rates_updated
• assignment_shift_updated
• assignment_trade_updated
• timesheet_approval_requested
• timesheet_approved
• timesheet_cancelled
• timesheet_unapproved
• timesheet_amended
• timesheet_deleted
• timesheet_marked_absent
• expense_created
• expense_rejected
• expense_approved
• expense_amended
• expense_deleted
• invoice_created
• invoice_paid
• credit_note_created
• credit_note_processed
• purchase_order_created
• purchase_order_amended
• purchase_order_expired
• purchase_order_deleted
• trade_created
• trade_amended
• trade_disabled
• rate_created
• rate_amended

Detailed event references (payload fields and examples) follow the OpenAPI x-webhooks contract and are linked under this section in the sidebar.

Delivery Model

• POST request is sent to your configured webhook URL for each event.
• Payload is JSON.
• Events are delivered at-least-once; consumers must handle duplicates safely.

Headers

Header	Description
Content-Type	Always application/json.
X-Requidex-Event	Event type (for example requisition_created).
X-Requidex-Event-Id	Unique event delivery id.
X-Requidex-Signature	HMAC SHA-256 signature of raw request body.
X-Requidex-Timestamp	UTC timestamp when event was signed.

Signature Verification

Use the webhook signing secret provided during onboarding.

1. Read the raw request body bytes.
2. Build signed payload as: timestamp + '.' + rawBody.
3. Compute HMAC SHA-256 using the signing secret.
4. Compare the computed digest with X-Requidex-Signature.
5. Reject if timestamp is too old (recommended: 5 minutes).

Event Envelope

{
  "id": "evt_01HYZ4KQJ4A9H2J7QZ8A4R7X9M",
  "type": "requisition_created",
  "createdAt": "2026-02-24T15:05:43.455Z",
  "data": {
    "requisition": {
      "id": "507f1f77bcf86cd799439011"
    }
  }
}

Event Payloads

requisition_created

Company-only. Triggered when a new requisition is created.

The payload includes only the requisition's full object ID. Fetch full details from:

• GET /api/open/v1/requisitions/{id}

{
  "id": "evt_01HYZ4KQJ4A9H2J7QZ8A4R7X9M",
  "type": "requisition_created",
  "createdAt": "2026-02-24T15:05:43.455Z",
  "data": {
    "requisition": {
      "id": "507f1f77bcf86cd799439011"
    }
  }
}

requisition_approved

Company-only. Triggered whenever an approval stage is completed.

The payload includes only the requisition's full object ID. Fetch full details from:

• GET /api/open/v1/requisitions/{id}

{
  "id": "evt_01HYZ4KXQ45Y8RD6MKJJ6RRA5S",
  "type": "requisition_approved",
  "createdAt": "2026-02-24T16:11:02.003Z",
  "data": {
    "requisition": {
      "id": "507f1f77bcf86cd799439011"
    }
  }
}

requisition_received

Agency-only. Triggered when a requisition is released to the agency, whether manually, after final approval, or through a scheduled tier transition.

The payload includes only the requisition's full object ID. Fetch full details from:

• GET /api/open/v1/requisitions/{id}

{
  "id": "evt_01K1RECEIVED7R6Q5P4N3M2L1",
  "type": "requisition_received",
  "createdAt": "2026-07-28T10:30:00.000Z",
  "data": {
    "requisition": {
      "id": "507f1f77bcf86cd799439011"
    }
  }
}

requisition_cancelled

Triggered when a requisition is cancelled. Company webhooks receive the event for their requisitions. Agency webhooks receive it only if the requisition was released to or responded to by that agency.

The payload includes only the requisition's full object ID. Fetch the latest details from:

• GET /api/open/v1/requisitions/{id}

{
  "id": "evt_01K1REQCANCELLED8Q7R6S5T4",
  "type": "requisition_cancelled",
  "createdAt": "2026-08-10T09:15:00.000Z",
  "data": {
    "requisition": {
      "id": "507f1f77bcf86cd799439011"
    }
  }
}

requisition_filled

Triggered when a requisition becomes filled. Company webhooks receive the event for their requisitions. Agency webhooks receive it only if the requisition was released to, responded to, or supplied by that agency.

The payload includes only the requisition's full object ID. Fetch the latest details from:

• GET /api/open/v1/requisitions/{id}

{
  "id": "evt_01K1REQFILLED9Q8R7S6T5U4",
  "type": "requisition_filled",
  "createdAt": "2026-08-10T09:30:00.000Z",
  "data": {
    "requisition": {
      "id": "507f1f77bcf86cd799439011"
    }
  }
}

requisition_worker_submitted

Company-only. Triggered when an agency submits one or more new workers to a requisition, either in its initial response or a later amendment.

The payload includes only the requisition's full object ID. Fetch the latest details from:

• GET /api/open/v1/requisitions/{id}

{
  "id": "evt_01K1REQSUBMITTED0R9S8T7U6",
  "type": "requisition_worker_submitted",
  "createdAt": "2026-08-17T09:45:00.000Z",
  "data": {
    "requisition": {
      "id": "507f1f77bcf86cd799439011"
    }
  }
}

requisition_worker_rejected

Triggered when a submitted worker is rejected. For an agency-scoped webhook, delivery is limited to the agency that submitted the rejected worker. The agency's submission and rejection reason are available in agencies[].submissions when fetching the requisition.

The payload includes only the requisition's full object ID. Fetch the latest details from:

• GET /api/open/v1/requisitions/{id}

{
  "id": "evt_01K1REQREJECTED0R9S8T7U6",
  "type": "requisition_worker_rejected",
  "createdAt": "2026-08-10T09:45:00.000Z",
  "data": {
    "requisition": {
      "id": "507f1f77bcf86cd799439011"
    }
  }
}

requisition_assigned

Triggered when one or more workers are assigned to a requisition. For an agency-scoped webhook, delivery is limited to the agency supplying the affected workers.

The payload includes only the requisition's full object ID. Fetch the latest details from:

• GET /api/open/v1/requisitions/{id}

{
  "id": "evt_01K1REQASSIGNED1S0T9U8V7",
  "type": "requisition_assigned",
  "createdAt": "2026-08-10T10:00:00.000Z",
  "data": {
    "requisition": {
      "id": "507f1f77bcf86cd799439011"
    }
  }
}

assignment_created

Triggered when an assignment is created.

The payload includes only the assignment's full object ID. Fetch full details from:

• GET /api/open/v1/assignments/{id}

{
  "id": "evt_01J0BB2DD7L3T0X9UM5Z6N8R9S",
  "type": "assignment_created",
  "createdAt": "2026-04-16T14:00:00.000Z",
  "data": {
    "assignment": {
      "id": "507f1f77bcf86cd799439012"
    }
  }
}

assignment_confirmed

Triggered when an assignment is confirmed.

The payload includes only the assignment's full object ID. Fetch full details from:

• GET /api/open/v1/assignments/{id}

{
  "id": "evt_01HZAZ8AA4H9P7T6QJ2W3K4M5N",
  "type": "assignment_confirmed",
  "createdAt": "2026-03-09T10:15:00.000Z",
  "data": {
    "assignment": {
      "id": "507f1f77bcf86cd799439012"
    }
  }
}

timesheet_approval_requested

Triggered when a timesheet is submitted for approval.

The payload includes only the timesheet's full object ID. Fetch full details from:

• GET /api/open/v1/timesheets/{id}

{
  "id": "evt_01J0AA1CC6K2S9W8TL4Y5M7Q8R",
  "type": "timesheet_approval_requested",
  "createdAt": "2026-04-16T12:00:00.000Z",
  "data": {
    "timesheet": {
      "id": "507f1f77bcf86cd799439013"
    }
  }
}

timesheet_approved

Triggered when a timesheet is approved.

The payload includes only the timesheet's full object ID.

{
  "id": "evt_01HZAZ9BB5J1R8V7SK3X4L6P7Q",
  "type": "timesheet_approved",
  "createdAt": "2026-03-09T10:45:00.000Z",
  "data": {
    "timesheet": {
      "id": "507f1f77bcf86cd799439013"
    }
  }
}

Additional Lifecycle Events

All new events use the same envelope shown above. The payload contains only the object ID under the key listed below. Deleted records cannot be fetched after delivery. Invoice events exclude drafts and AFPs. Agency delivery is restricted to records belonging to that agency and excludes MSP-to-client invoices and credit notes.

Event	Payload ID	Trigger
timesheet_cancelled	data.timesheet.id	Sent when a timesheet is cancelled by raising its credit note.
timesheet_unapproved	data.timesheet.id	Sent when a timesheet is unapproved.
timesheet_amended	data.timesheet.id	Sent when a timesheet is amended.
timesheet_deleted	data.timesheet.id	Sent when a timesheet is deleted.
timesheet_marked_absent	data.timesheet.id	Sent when a timesheet is marked absent.
expense_created	data.expense.id	Sent when an expense is created.
expense_rejected	data.expense.id	Sent when an expense is rejected.
expense_approved	data.expense.id	Sent when an expense is approved.
expense_amended	data.expense.id	Sent when an expense is amended.
expense_deleted	data.expense.id	Sent when an expense is deleted.
invoice_created	data.invoice.id	Sent when an invoice is created. Draft invoices and applications for payment (AFPs) do not send invoice events.
invoice_paid	data.invoice.id	Sent when an invoice is paid. Draft invoices and applications for payment (AFPs) do not send invoice events.
credit_note_created	data.creditNote.id	Sent when a credit note is created.
credit_note_processed	data.creditNote.id	Sent when a credit note is processed.
purchase_order_created	data.purchaseOrder.id	Company-only. Sent when a purchase order is created.
purchase_order_amended	data.purchaseOrder.id	Company-only. Sent when a purchase order is amended.
purchase_order_expired	data.purchaseOrder.id	Company-only. Sent when a purchase order is expired.
purchase_order_deleted	data.purchaseOrder.id	Company-only. Sent when a purchase order is deleted.
trade_created	data.trade.id	Company-only. Sent when a trade is created
trade_amended	data.trade.id	Company-only. Sent when a trade is amended
trade_disabled	data.trade.id	Company-only. Sent when a trade is disabled
rate_created	data.rate.id	Company-only. Sent when a rate is created
rate_amended	data.rate.id	Company-only. Sent when a rate is amended

Retry and Failure Behavior

• 2xx response: delivery is marked successful.
• Non-2xx or timeout: delivery is retried with exponential backoff.
• Recommended consumer timeout: respond within 10 seconds.
• Deduplicate events using X-Requidex-Event-Id.

Idempotency Guidance

Your webhook handler should be idempotent by event id:

• Store processed event ids.
• Ignore already-processed ids.
• Treat out-of-order arrival as expected.