Receive TheirStack events in your webhook endpoint

If you are building your own webhook endpoint, please take into account the following:

Return a 2xx status code to indicate that the webhook event was received and processed successfully. Failed webhook events are retried every hour for 48 hours.
Your webhook endpoint has to be prepared to handle at least 2 concurrent requests.
Your webhook endpoint has to be prepared to handle duplicates. Our system is designed to not send the same job twice to your webhook URL. However, this could happen in some edge cases (e.g: you listen to two searches with not exclusive jobs). You can use the id field to deduplicate jobs.
When a webhook sends data, it uses an HTTP POST request, with a JSON payload. Each webhook event contains only one record (job or company).
Webhook event schemas vary by event type. job.new uses the full Job schema and company.new uses the full Company schema. job.closed uses a minimal payload: { "id": 123, "closed_at": "2026-06-08T14:00:00Z" }. See each event type reference for the exact schema.
If you have configured a signing secret, each delivery includes an X-TheirStack-Signature-256 header that you should verify to ensure the payload was sent by TheirStack and has not been tampered with.

If you are building your own webhook endpoint, please take into account the following:

Return a 2xx status code to indicate that the webhook event was received and processed successfully. Failed webhook events are retried every hour for 48 hours.
Your webhook endpoint has to be prepared to handle at least 2 concurrent requests.
Your webhook endpoint has to be prepared to handle duplicates. Our system is designed to not send the same job twice to your webhook URL. However, this could happen in some edge cases (e.g: you listen to two searches with not exclusive jobs). You can use the id field to deduplicate jobs.
When a webhook sends data, it uses an HTTP POST request, with a JSON payload. Each webhook event contains only one record (job or company).
Webhook event schemas vary by event type. job.new uses the full Job schema and company.new uses the full Company schema. job.closed uses a minimal payload: { "id": 123, "closed_at": "2026-06-08T14:00:00Z" }. See each event type reference for the exact schema.
If you have configured a signing secret, each delivery includes an X-TheirStack-Signature-256 header that you should verify to ensure the payload was sent by TheirStack and has not been tampered with.