Webhooks
Have Sume call your server when a job finishes.
Set mode: "webhook" and a webhook_url on any generate request, and Sume POSTs the outcome to that URL when the job reaches a terminal state.
The URL must be public HTTPS. Localhost, private-network and plain HTTP URLs are rejected when you submit.
Events
Sume sends terminal events only, one per job:
| Event | When |
|---|---|
job.completed | The job completed. payload.artifacts holds the output. |
job.failed | The job failed. error says why. |
job.canceled | The job was canceled. |
Failed and canceled events use "status": "ERROR" and carry an error object.
Verify the signature
Every delivery is signed. Sume computes HMAC-SHA256 over <timestamp>.<raw body> with your workspace's signing secret and sends:
Read the signing secret on the Webhooks tab of the dashboard. During a secret rotation the signature header holds one sume-v1= entry per live secret, separated by commas; accept the delivery if any entry matches. Reject deliveries whose timestamp is more than five minutes old.
Respond and dedupe
Answer with any 2xx after you have stored the event. A delivery can arrive more than once; dedupe on job_id. If your endpoint is down, read the job with Get job status: the job's webhook_delivery field records what was sent.
A delivery that gets no 2xx is tried again up to 10 times in all: 30 seconds after the first try, then twice as long after each one, never more than an hour apart, about three hours in total. After the last try, POST /v1/jobs/{id}/webhook/redeliver sends it again.