Webhooks
AlphaCount calls your URL when something happens in a company's books.
A webhook sends an event to a URL you choose: an invoice was paid, a document needs review, a booking was made.
Zapier, Make and n8n take such a URL as they are; your own service needs an endpoint that accepts a POST.
Set one up
An admin of the organization, in AlphaCount: Integrations → Webhooks → New webhook. Choose the
company, the address and the events. The signing secret (whsec_…) is shown once — store it
next to your endpoint. One webhook per company can carry every event you need.
Send test sends webhook.test, so you can check your endpoint before anything real happens.
The request
POST /your/endpoint
Content-Type: application/json
User-Agent: AlphaCount-Webhooks/1
X-AlphaCount-Event: invoice.paid
X-AlphaCount-Delivery: 5a0b…
X-AlphaCount-Signature: t=1791374400,v1=3f2a…The body is the envelope as compact JSON:
{
"id": "e1d2c3b4-a5f6-4e7d-8c9b-0a1f2e3d4c5b",
"type": "invoice.paid",
"api_version": "2026-10-07",
"created_at": "2026-10-20T07:00:12Z",
"legal_entity": { "id": "4b7d…", "name": "Alpha Akademie GmbH" },
"data": { }
}data is different per event — see Events. Verify the signature
before you trust a request.
Answer quickly
Any 2xx counts as delivered. Answer at once and do the work afterwards: AlphaCount waits 5 seconds to connect and 10 seconds for the answer, does not follow redirects, and does not read the answer's body.
Retries
A delivery that did not get a 2xx is tried again:
| After failure | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
|---|---|---|---|---|---|---|---|
| next attempt in | 1 min | 5 min | 30 min | 2 h | 6 h | 24 h | — given up |
After 20 deliveries in a row that were given up, the webhook is switched off and the organization's admins are notified. Switching it on again starts the count anew. The app shows every delivery of the last 30 days, with its status, and can send one again.
Each event once — by its id
Events can arrive more than once and in a different order than they happened. The envelope's id is the same for
every delivery of the same event — use it as your idempotency key. created_at says when it happened.
X-AlphaCount-Delivery is new for every attempt.
What a payload never contains
A payload carries ids, dates, amounts, numbers, names of counterparties and accounts, status and a link into the app. It never carries file contents, IBANs, tax numbers, addresses, e-mail addresses, free text such as a transfer's purpose or an invoice's lines, or anything about another company. Fetch details with the API where you need them.
Where a URL may point
https only, and every address the host resolves to must be public — no loopback, private, link-local or reserved
ranges. AlphaCount checks the address when the webhook is saved and again before every request, and connects to the
address it checked. The certificate must be valid for the host.