Webhooks

Webhooks allow your app to receive real-time HTTP POST requests from Mojave whenever specific events happen — such as when a time entry is created, an invoice is sent, or a user is added.

They’re useful for syncing data with external tools, triggering automations, or keeping your internal systems updated without polling the API.

How Webhooks Work

When you subscribe to a webhook event, Mojave will send an HTTP POST request to the endpoint you provide, containing a signed payload with event details.

Each event includes a type, a timestamp, and a full copy of the resource object (e.g. a time entry or invoice).

Example Payload

{
  "type": "time_entry.created",
  "timestamp": 1712742800,
  "data": {
    "id": "te_83hskd9a",
    "project_id": "prj_2981dkf8",
    "user_id": "usr_73fhsla1",
    "notes": "Kickoff call with client",
    "start_time": "2025-04-10T09:00:00Z",
    "end_time": "2025-04-10T10:30:00Z"
  }
}

Supported Events

More events will be added in future updates.

Creating a Webhook

POST /webhooks

Request body:

{
  "url": "https://yourapp.com/webhooks/mojave",
  "events": ["time_entry.created", "invoice.paid"]
}

Response:

{
  "id": "wh_3928shfd",
  "url": "https://yourapp.com/webhooks/mojave",
  "events": ["time_entry.created", "invoice.paid"],
  "created_at": "2025-04-10T12:00:00Z"
}

Verifying Requests

Each request will contain a X-Mojave-Signature header, which you can use to verify the payload’s authenticity.

Steps:

1. Retrieve your webhook secret from Settings → Webhooks

2. Recreate the signature using your secret and payload

3. Compare it to the X-Mojave-Signature header using a secure comparison

🔐 Verification is strongly recommended to prevent spoofed requests.

Retry Logic

If your webhook endpoint fails (non-2xx response), Mojave will retry:

• Up to 5 times

• With exponential backoff (starting at 1 min)

You can monitor failed deliveries and logs in your dashboard.

Best Practices

• Respond with a 200 OK as quickly as possible

• Process events asynchronously if needed

• Use idempotency to avoid duplicate handling

• Always verify payload signatures