# Webhooks Register HTTPS endpoints in the [developer console](https://studio.biosimulant.com/developer). Per-run callback URLs are not accepted. Supported events are: - `run.queued` - `run.started` - `run.completed` - `run.failed` - `run.cancelled` - `run.timed_out` The signing secret is shown once. Store it in a secret manager. ## Verify every request Biosimulant sends the raw JSON payload with: ```text Biosimulant-Signature: t=,v1= Biosimulant-Event-Id: ``` ```python from biosimulant import verify_webhook_signature verify_webhook_signature( raw_request_body, request.headers["Biosimulant-Signature"], webhook_secret, ) ``` Verification rejects malformed signatures and timestamps outside the default five-minute tolerance. Verify before parsing or acting on the event. ## Delivery behavior Events are written to a transactional outbox and delivered independently from the run request. Non-2xx responses and transport failures retry with exponential backoff up to the configured attempt limit. The developer console shows attempt count, response status, last error, and final delivery state. Return `2xx` quickly, store the event ID for idempotent processing, and move expensive work to your own queue.