Webhook endpoints

Send backup events to your own URL so you can integrate Avada Backups & Restore with your monitoring, ticketing, or DevOps tooling.

How webhooks work

When an event occurs (backup started, restore completed, etc.), Avada Backups & Restore sends an HTTP POST request to the URL you've registered. The body is a JSON payload describing the event.

Webhooks are signed with HMAC-SHA256 so you can verify the request came from Avada Backups & Restore.

Adding an endpoint

You can register up to 3 endpoints per store.

Payload format

{
  "event": "backup.completed",
  "timestamp": "2026-05-04T06:00:42Z",
  "store_domain": "your-store.myshopify.com",
  "data": {
    "backup_id": "bk_a1b2c3",
    "type": "scheduled",
    "duration_seconds": 142,
    "file_count": 3284,
    "size_bytes": 218491203
  }
}

Verifying signatures

Each request includes an X-Avada-Signature header. Verify it as follows:

const crypto = require('crypto')
 
function verify(req, secret) {
  const signature = req.headers['x-avada-signature']
  const expected = crypto
    .createHmac('sha256', secret)
    .update(req.rawBody)
    .digest('hex')
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  )
}

The signing secret is shown once when you create the endpoint — store it in your secrets manager. To rotate it, click Regenerate secret on the endpoint detail page.

Retries

If your endpoint returns a non-2xx status or times out (10s), Avada Backups & Restore retries with exponential backoff:

After 5 failed attempts the event is dropped and a notification is sent. You can replay any dropped event from the Webhook log.

Webhook log

The log shows the last 1,000 deliveries per endpoint with status, response code, and response body. Click any row to view the full request/response and Replay if needed.