{"openapi":"3.1.0","info":{"title":"Hasabi Webhooks & Event Streams API","description":"Real-time outbound event notifications for Parties, Items, and Transactions in Hasabi ERP. Designed for AI agents, automations, and custom microservices.","version":"v1"},"components":{"securitySchemes":{"HmacSignature":{"type":"apiKey","in":"header","name":"X-Hasabi-Signature","description":"HMAC SHA-256 signature calculated over timestamp + \".\" + request body using the webhook secret key."},"Timestamp":{"type":"apiKey","in":"header","name":"X-Hasabi-Timestamp","description":"Unix epoch timestamp in seconds. Replay tolerance is 300 seconds (5 minutes)."}},"schemas":{"WebhookPayloadEnvelope":{"type":"object","required":["id","event","api_version","timestamp","company","entity_type","data"],"properties":{"id":{"type":"string","example":"evt_01j7xyz89..."},"event":{"type":"string","example":"sale_invoice.created"},"api_version":{"type":"string","example":"v1"},"timestamp":{"type":"string","format":"date-time"},"company":{"type":"object","properties":{"id":{"type":"integer","nullable":true},"name":{"type":"string"},"phone":{"type":"string","nullable":true}}},"entity_type":{"type":"string","example":"sale_invoice"},"data":{"type":"object","description":"Normalized entity attributes"},"changes":{"type":"object","description":"Present on *.updated events containing field-level diffs","additionalProperties":{"type":"object","properties":{"previous":{"description":"Value before update"},"current":{"description":"Value after update"}}}}}}}},"events":{"transaction.*":"Fires on any transaction event.","transaction.created":"Fired when any transaction (Sale, Purchase, Payment, Expense, Return) is created.","sale_invoice.created":"Fired specifically on new Sale Invoices.","purchase_bill.created":"Fired specifically on new Purchase Bills.","payment_in.created":"Fired on customer payments received.","payment_out.created":"Fired on payments made to suppliers.","sale_return.created":"Fired on credit notes \/ sale returns.","party.*":"Fires on any party creation, update, or deletion.","party.created":"Fired when a customer or supplier is created.","party.updated":"Fired when party details are modified (includes changes diff).","party.deleted":"Fired when a party is soft-deleted.","item.*":"Fires on any item creation, update, deletion, or stock adjustment.","item.created":"Fired when a product or service is created.","item.updated":"Fired when an item name, price, or tax rate changes (includes changes diff).","item.deleted":"Fired when an item is soft-deleted.","item.stock_adjusted":"Fired on manual stock adjustments (ADD\/REDUCE)."},"paths":{"\/api\/v1\/webhooks\/verify":{"get":{"summary":"Verify webhook credentials and subscribed channels (GET)","description":"Verify the authenticity of a webhook signing secret, view company scope, and inspect all subscribed channels or test a specific event.","parameters":[{"name":"secret","in":"query","required":true,"description":"The webhook endpoint signing secret key.","schema":{"type":"string"}},{"name":"channel","in":"query","required":false,"description":"Optional event\/channel to check subscription for (e.g. sale_invoice.created, item.updated).","schema":{"type":"string"}}],"responses":{"200":{"description":"Secret is valid and configuration details returned."},"400":{"description":"Secret key parameter missing."},"404":{"description":"No webhook matched the provided secret key."}}},"post":{"summary":"Verify webhook credentials and subscribed channels (POST)","description":"POST variant for programmatic verification without exposing secrets in URLs\/server access logs.","requestBody":{"required":true,"content":{"application\/json":{"schema":{"type":"object","required":["secret"],"properties":{"secret":{"type":"string","description":"Signing secret key"},"channel":{"type":"string","description":"Event\/channel name to check"}}}}}},"responses":{"200":{"description":"Secret is valid and configuration details returned."},"400":{"description":"Secret key parameter missing."},"404":{"description":"No webhook matched the provided secret key."}}}}}}