Webhook (outbound)
Last updated 2 September 2026.
The one call that goes the other way. If you register a webhook URL, Trivela sends this when a value the player is shown may have moved. It is a nudge to re-read, and carries nothing else.
What Trivela sends
POST <your registered webhook URL>
Authorization: Bearer wh_yourservice_…
Content-Type: application/json
{ "subject": "u_8f31c2" }| Field | Type | Rules | |
|---|---|---|---|
subject | string | required | Your own subject for the player whose values may have changed. Never the field, never a value. |
- Timeout: 2 seconds. No retries, no delivery log.
- Sent after
/api/link/statuswhen a report moved a shared value, and after a player edits a field on their account page. Never from/api/link/report. - The secret is minted when the URL is registered and shown once. Registering a new URL mints a new secret.
What you should answer
202Always, for anything past the bearer check — linked, not linked, unknown subject, Trivela unreachable. Empty body. Answer before doing the work.
400Only for an unparseable body or a non-string subject. Says nothing about any user.
401Bad or missing bearer. Compare in constant time; fail closed if your secret is not configured.
A 404 for an unknown subject would let anyone holding the secret ask whether an id is one of your users. Do not distinguish.
What to do on receipt
Inside after() or equivalent, once the 202 is sent: make your ordinary /api/link/status call over your own key, with no subjectLabel and no values, and run the same apply code your render path runs. Never end a link from a ping.