Webhooks: Receive Scored Opportunities Anywhere

• •HMAC-SHA256 signed payloads. Every request includes an X-Prowlo-Signature header you verify against your per-webhook signing secret.
• •Automatic retries with exponential backoff. Non-2xx responses re-queue. The delivery log shows every attempt.
• •Test endpoint + manual replay. Fire a sample payload immediately on creation; replay any failed delivery from the dashboard.
• •Auto-disable on consecutive failures. If your endpoint stays broken, the webhook auto-disables with a clear reason instead of silently dropping signal.
• •Available on every plan. Webhooks are not gated to enterprise. Same primitives on the $23/mo Starter as on Growth.

Every payload is JSON with this shape:

{
  "event": "curation.batch.ready",
  "event_id": "evt_01H8XYZ...",
  "delivered_at": "2026-04-29T19:12:33.421Z",
  "organization_id": "org_01H...",
  "data": {
    "batch_id": "batch_01H...",
    "opportunities": [
      {
        "id": "opp_01H...",
        "post_id": "abc123",
        "subreddit": "r/SaaS",
        "title": "Anyone know a good tool for finding Reddit leads?",
        "url": "https://reddit.com/r/SaaS/comments/abc123",
        "scores": {
          "fit": 95,
          "relevance": 0.63,
          "survival": "MEDIUM"
        },
        "engagement_brief": {
          "verdict": "Safe to engage",
          "approach": "Answer first, then mention soft",
          "warnings": ["No direct links — mods remove them"]
        }
      }
    ]
  }
}

The exact shape of data depends on the event type. Always check the top-level event field in your handler before parsingdata.

Prowlo signs every payload with HMAC-SHA256 over the raw request body, using your per-webhook signing secret. The signature ships in the X-Prowlo-Signature header, hex-encoded.

Always verify in constant time before processing the payload.

Node.js (Express)

import crypto from 'node:crypto';
import express from 'express';

const app = express();
const SECRET = process.env.PROWLO_WEBHOOK_SECRET;

// IMPORTANT: capture the raw body for signature verification
app.use('/prowlo', express.raw({ type: 'application/json' }));

app.post('/prowlo', (req, res) => {
  const signature = req.header('X-Prowlo-Signature');
  const expected = crypto
    .createHmac('sha256', SECRET)
    .update(req.body)         // raw Buffer, not parsed JSON
    .digest('hex');

  const ok = signature && crypto.timingSafeEqual(
    Buffer.from(signature, 'hex'),
    Buffer.from(expected, 'hex'),
  );
  if (!ok) return res.status(401).send('bad signature');

  const payload = JSON.parse(req.body.toString('utf8'));
  // ... handle payload.event, payload.data ...

  res.status(200).send('ok');
});

Python (Flask)

import hashlib
import hmac
import os
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ['PROWLO_WEBHOOK_SECRET'].encode('utf-8')

@app.post('/prowlo')
def prowlo_webhook():
    signature = request.headers.get('X-Prowlo-Signature', '')
    expected = hmac.new(SECRET, request.data, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(signature, expected):
        abort(401)
    payload = request.get_json(force=True)
    # ... handle payload['event'], payload['data'] ...
    return ('', 200)

curl (manual test)

# Compute the expected signature for a known payload
echo -n '{"event":"curation.batch.ready","event_id":"evt_test"}' \
  | openssl dgst -sha256 -hmac "$PROWLO_WEBHOOK_SECRET" \
  | awk '{print $2}'

Use this to verify your handler matches what Prowlo would compute on the same body.

• •Retry policy. Any non-2xx response triggers a retry with exponential backoff. Successive failures get progressively longer delays.
• •Delivery log. Every attempt is logged with status code, response body snippet, and error message. Filter by webhook or status. Found in the dashboard at Notifications → Webhooks → Deliveries.
• •Manual replay. Click Redeliver on any failed entry to re-fire the original payload. Useful after deploying a fix to your handler.
• •Auto-disable. If your endpoint fails consecutively past the failure threshold, the webhook auto-disables with a clear reason (timeouts, 5xx, signature mismatch, etc.). Re-enable from the Webhooks page once your endpoint is fixed.
• •Idempotency. The event_id field is stable across retries. Use it as your idempotency key so a replay does not duplicate downstream side effects.