Webhooks

Register HTTPS endpoints in the developer console. Per-run callback URLs are not accepted.

Supported events are:

• run.queued
• run.started
• run.completed
• run.failed
• run.cancelled
• run.timed_out

The signing secret is shown once. Store it in a secret manager.

Verify every request

Biosimulant sends the raw JSON payload with:

Biosimulant-Signature: t=<unix_timestamp>,v1=<hex_hmac>
Biosimulant-Event-Id: <event_id>

from biosimulant import verify_webhook_signature
 
verify_webhook_signature(
    raw_request_body,
    request.headers["Biosimulant-Signature"],
    webhook_secret,
)

Verification rejects malformed signatures and timestamps outside the default five-minute tolerance. Verify before parsing or acting on the event.

Delivery behavior

Events are written to a transactional outbox and delivered independently from the run request. Non-2xx responses and transport failures retry with exponential backoff up to the configured attempt limit. The developer console shows attempt count, response status, last error, and final delivery state.

Return 2xx quickly, store the event ID for idempotent processing, and move expensive work to your own queue.