Webhook signature

When an emergency notification is acknowledged, a POST with this body is sent to the callback address:

{ "receipt": "…", "acknowledged": true, "acknowledged_at": 1793057112, "acknowledged_by": "u_…", "acknowledged_by_device": "iphone" }

When an http button in a notification is tapped, a POST with this body is sent to the button’s address (user is the project-specific key for someone who subscribed; the same person tapping again within 10 seconds counts as one request):

{ "event": "action", "message_id": "01a17…", "action": { "index": 0, "title": "Open the door" }, "user": "u_…", "device": "iphone", "at": 1793057112 }

Verify the PushBell-Signature: t=<unix>,v1=<hex> header with the project’s webhook secret (in the dashboard, the project’s Settings page → Webhook signing secret): v1 = HMAC-SHA256(secret, t + "." + body). Reject t values older than 5 minutes. If your response isn’t 2xx, the request is retried after 1 minute, then at growing intervals (up to 1 hour) for 24 hours.

import crypto from "node:crypto";

function verify(secret, header, body) {
  const [, t, v1] = /t=(\d+),v1=([0-9a-f]+)/.exec(header) ?? [];
  if (!t || Math.abs(Date.now() / 1000 - Number(t)) > 300) return false;
  const want = Buffer.from(crypto.createHmac("sha256", secret).update(`${t}.${body}`).digest("hex"));
  const got = Buffer.from(v1);
  return want.length === got.length && crypto.timingSafeEqual(want, got);
}

Event subscriptions

To get all of a project’s emergency acknowledgements at one address instead of a callback per message (for automations such as Zapier, Make, n8n), subscribe with a project API key:

curl -X POST https://api.pushbell.app/v1/hook-subscriptions \
  -H "Authorization: Bearer pb_live_…" -H "Content-Type: application/json" \
  -d '{"event": "emergency.acknowledged", "url": "https://example.com/pushbell/event"}'

When someone acknowledges an emergency notification, a signed POST with this body goes to the URL (signature and retries as above):

{ "id": "rL3f…", "event": "emergency.acknowledged", "project_id": "…", "receipt": "rL3f…", "message_id": "…", "title": "Smoke alarm", "acknowledged_at": 1793057112, "acknowledged_by": "u_…", "acknowledged_by_device": "iphone" }

id is unique per event; use it to skip an event that arrives twice. List subscriptions with GET /v1/hook-subscriptions, delete with DELETE /v1/hook-subscriptions/{id}. When the key that created a subscription is disabled, no events are sent. A project can have up to 25 subscriptions. Recent events: GET /v1/events?event=emergency.acknowledged&limit=10.