Send AI extraction completion events through signed webhooks

Send the result with a signature. Illustrative example.

OUT: POST /api/webhooks, POST /api/webhooks/:id/test

Content reviewed 2026-09-11.

Document extraction webhooks tell your system when the work is done. Dynamite Docs sends an extraction.completed event to your endpoint, signs the raw body with HMAC-SHA256 and retries temporary failures. You can register up to five endpoints per account. No polling loop required.

Open this integration in the app or read the public API and webhook guide.

Polling wastes requests and still finds the result late

Scripts that poll for new extractions burn requests and lag by the poll interval. Nobody wants their document pipeline to be as stale as the last cron run.
An unauthenticated webhook is a spoofing hole. Anyone can POST a fake event, and a receiver that trusts it acts on data that never existed.
Transient failures (a 429, a 5xx, a network blip) should be retried, not dropped. A lost event is a silent data gap.
Webhook payloads that are not signed leave the receiver guessing whether the event is real.

How webhooks work

01. Register an endpoint

Create a webhook with an HTTPS URL, up to five per account. Endpoints are validated as public URLs (SSRF-guarded) so the service never posts to internal addresses.

02. Get the secret

Your webhook secret is shown once at creation and used to verify signatures. You confirm the endpoint by its signature. Nothing is trusted on the URL alone.

03. Receive the event

When an extraction completes, we POST the extraction.completed payload with columns, rows, metadata, and confidence, signed in the X-Dynamite-Signature header.

04. Verify and retry

Verify the HMAC-SHA256 signature over the raw body before acting. Network errors, 429s, and 5xx retry with exponential backoff and jitter, up to three attempts.

Webhook payload and delivery

The webhook contract is short enough to verify:

Event: extraction.completed
Endpoints: up to 5 per account
Signature: HMAC-SHA256 in X-Dynamite-Signature
Payload: columns, rows, metadata, confidence
Retries: backoff + jitter, 3 attempts, 10s timeout
SSRF guard: public URLs only, internal targets rejected
Test button: POST /api/webhooks/:id/test

The webhook endpoints panel in Dynamite Docs with delivery status — Register up to five endpoints and test them from the workspace.

A realistic example

The payload your endpoint receives and how to verify it:

Field	Example	Purpose
event	extraction.completed	Tells the receiver what happened
data.columns	["Invoice #", "Date", "Total"]	The table headers
data.rows	[["INV-2041", "2026-06-03", "1240.00"]]	The extracted rows
data.confidence	0.97	Average confidence of the extraction
X-Dynamite-Signature	hmac-sha256 hex digest	Proof the event is genuine

What webhooks do and do not

Does

POST extraction.completed events to your HTTPS endpoints with an HMAC-SHA256 signature over the raw body.
Retry transient failures (network, 429, 5xx) with exponential backoff and jitter, up to three attempts.
Reject non-public/internal target URLs to keep delivery SSRF-safe.

Does not

Does not send the full document bytes. Webhooks carry the extracted data, not the file.
Does not retry forever: three attempts max, so a broken endpoint cannot be hammered.
Does not deliver to endpoints that cannot verify the signature. Verification is the receiver’s job, and the secret is shown once.

Why webhooks complete the outbound story

Push beats poll. An event the moment extraction completes means your downstream systems act in real time, not on the last cron run.

HMAC signing makes delivery verifiable. The receiver can prove an event is genuine before trusting a single field.

Retries with backoff and an SSRF guard make the contract reliable and safe, so the webhook channel can be trusted for production traffic.

Questions, answered

What does a webhook event contain?

The extraction.completed payload: columns, rows, metadata, docType, and confidence. It carries the extracted data, not the source document bytes.

How do I verify the signature?

Compute HMAC-SHA256 over the raw request body using your webhook secret and compare it to the X-Dynamite-Signature header with a constant-time comparison.

How many endpoints can I have?

Up to five per account. Each has its own secret and can be tested independently from the workspace.

What happens if delivery fails?

Network errors, 429s, and 5xx retry with exponential backoff and jitter, up to three attempts with a per-attempt timeout.