Backend Event Webhook

this document describes how external systems can send backend (server side) events to appstorys using the appstorys webhook endpoint this webhook is intended for trusted backend integrations and uses a static api token for authentication overview the appstorys backend event webhook allows your backend services to push event data directly into appstorys common use cases include backend triggered user actions conversion and transactional events system or lifecycle events each event is authenticated, validated, and stored by appstorys endpoint post https //tracking appstorys com/webhooks https //tracking appstorys com/webhooks authentication authorization header (required) authentication is performed using a static api token provided by appstorys do not use bearer or any other prefix authorization \<your api token> requests with a missing, invalid, or expired token will be rejected headers content type application/json authorization \<your api token> request body the request body must be valid json required fields if event type is provided, it will be internally mapped to event example requests standard event { "user id" "user 12345", "event" "purchase completed", "metadata" { "order id" "ord 9021", "amount" 149 99, "currency" "usd" } } using event type { "user id" "user 12345", "event type" "email verified", "metadata" { "method" "otp" } } event processing details appstorys automatically assigns and manages the following a unique event id client identity derived from your api token event source set to clientbackend server side event timestamp clients must not include these fields in the payload validation rules a request will be rejected if the authorization header is missing or invalid the request body is not valid json user id is missing or not a string neither event nor event type is provided metadata is missing or is not a valid json object responses success a successful response is http code 204, which indicates that no content is available \<font color="#15803d">http 204 no content\</font> error responses retry & idempotency the webhook does not enforce idempotency retrying the same request may result in duplicate events clients should design their integrations to tolerate duplicates if retries are used best practices use consistent, descriptive, snake case event names keep metadata structured and concise avoid sending sensitive personal data unless explicitly approved send backend events only when client side tracking is insufficient api token management & support api tokens are issued by appstorys for token provisioning, rotation, or integration support, contact appstorys through support\@appstorys com or slack