Source · Exa · Verified November 1, 2026
Exa
Short answer: Exa Websets webhooks report search, item, monitor run, import and export lifecycle events for research pipelines.
Hooks verifies Exa deliveries with hmac-sha256, lowercase hex over <timestamp>.<raw body>; exa-signature carries t=<unix>,v1=<hex> and any matching v1 passes and normalizes them into the unified event format.
Set up the webhook in Exa
- Create a webhook in the Exa dashboard or call
POST https://api.exa.ai/websets/v0/webhookswith the Hooks receive URL and the events you need. - The response includes a
secretthat is only returned once; copy it into the Hooks source secret field. - Exa sends
Exa-Signature: t=<unix>,v1=<hex>; Hooks checks the 5-minute window and accepts any matchingv1value (secret rotation). - Exa does not follow redirects, so register the final HTTPS URL. Retries reuse the same event
id, which Hooks uses for dedupe.
Signature verification
| Header | Exa-Signature |
|---|---|
| Algorithm | HMAC-SHA256, lowercase hex over <timestamp>.<raw body>; Exa-Signature carries t=<unix>,v1=<hex> and any matching v1 passes |
| Replay window | 5 minutes |
| Delivery id | Body `id` |
Events Hooks normalizes
| event.type | subject | What it means |
|---|---|---|
webset.search.completed | event | Exa Websets webhooks report search, item, monitor run, import and export lifecycle events for research pipelines. |
Normalized payload
Every adapter produces this shape before filters or templates run. The raw payload and sanitized headers stay attached for audit, but filters and templates read the normalized fields.
Normalized event
{
"id": "evt_demo",
"source": "exa",
"type": "webset.search.completed",
"action": "completed",
"deliveryId": "delivery_demo",
"subject": {
"title": "Exa event"
},
"raw": {
"id": "evt_2d9f1c7a-4b3e-4c8a-9f10-6e5d4c3b2a10",
"object": "event",
"type": "webset.search.completed",
"data": {
"id": "ws_search_8f3c2a1d",
"object": "webset_search",
"websetId": "ws_7c1e9b40",
"status": "completed",
"query": "AI infrastructure startups"
},
"createdAt": "2026-11-08T12:00:00.000Z"
}
}Filter and template examples
Filter
type equals "webset.search.completed"Template
"Exa event: {{event.subject.title}}"Retries and the delivery log
408, 425, 429, and 5xx responses retry with backoff and honor Retry-After; other 4xx responses fail permanently with a named code. Every attempt keeps the rendered request and the target response, so a failure points at one field or one status instead of a guess.

Common errors
| Symptom | Fix |
|---|---|
SIGNATURE_INVALID | Use the signing secret Exa shows when the webhook is created, and send Exa-Signature for the exact raw body. |
Nothing arrives | Confirm the webhook points at the endpoint's /in/<endpoint-id> URL and that the endpoint is active. |
Pair with a target
Reference
- Receiving eventshttps://exa.ai/docs/websets/api/webhooks/create-a-webhook
- Verify signatureshttps://hooks.events/docs/signatures.md
- Payload templateshttps://hooks.events/docs/templates.md
Other sources
X-Hook-Secret handshake.Auth0Auth0 custom log streams POST tenant log events (login, signup, logout, token exchange, user changes) to a webhook.AWS SNSAWS SNS delivers JSON notifications and subscription confirmations to HTTP(S) endpoints, signed with an RSA certificate published under an sns.<region>.amazonaws.com URL.Azure DevOpsAzure DevOps service hooks send git pushes, pull requests, work items, builds and releases to a public webhook endpoint.BitbucketBitbucket Cloud repository webhooks cover pushes, pull request changes, and issue events.BrowserbaseBrowserbase Functions webhooks report invocation and build lifecycle states (pending, running, completed, failed).Cal.comCal.com booking webhooks wrap the booking in a triggerEvent envelope and sign each delivery with an HMAC-SHA256 of the raw body.Browse all sourcesSetup steps, signatures, events, and payload samples for every provider.