One-page lookup for all technical specifications. Explanations live in the linked pages.
| Specification | Value |
|---|---|
| Protocol | HTTPS only (valid CA-issued certificate, TLS 1.2+) |
| Method | POST |
| Content type | application/json |
| Response timeout | 15 seconds |
| Success codes | 200 OK, 202 Accepted, 204 No Content; anything else retries |
| Retry pattern | 5→10→20→40→80 min, repeating; max delay 80 min (details) |
| Deregistration threshold | Per webhook (event type): 25 consecutive failures and 2+ days elapsed; any success resets both |
| Signature | HMAC-SHA256 over raw body, base64-encoded, using your Signing Secret |
| Retry payload | Identical across retries; only delivery headers change |
Static egress IPs, guaranteed not to change. Allowlist all four; the reserved pair may come into use without notice.
| Status | IP addresses |
|---|---|
| Active | 3.19.83.19118.118.90.214 |
| Reserved | 32.188.140.8335.80.104.162 |
| Header | Purpose |
|---|---|
X-Echo-Hmac-SHA256 | Payload signature; verify with your Signing Secret |
X-Echo-Timestamp | Current attempt timestamp (UTC ISO 8601) |
X-Echo-Timestamp-Original | First attempt timestamp |
X-Echo-Retry-Attempt | 0 initial, increments per retry |
X-Echo-Webhook-Id | Unique event Id; use for idempotency |
Authorization | OAuth bearer token or Basic Auth credentials, if configured |
| API key / custom headers | As configured at registration |
Details and retry behavior: Receiving & Verifying Webhooks
You create it and give it to Echo at registration; Echo does not assign it. Echo signs every payload with it; you verify. Not to be confused with endpoint authentication below, or with an OAuth client_secret.
| Requirement | Specification |
|---|---|
| Length | 24–128 characters |
| Required characters | 1 uppercase, 1 lowercase, 1 number |
| Special characters | Recommended, not required |
Allowed symbols
@ # $ % & * ! ? [ ] { } ( ) < > + - _ . , : ; ~ ` ^ | \ /Credentials Echo presents so your endpoint/gateway accepts the request. Does not replace the Signing Secret.
| Method | Configuration |
|---|---|
| API key | Your header name + value, sent on every request |
| Basic Auth | Header pair: Authorization + Basic <base64(username:password)>; mutually exclusive with OAuth |
| OAuth 2.0 | Client credentials flow: endpoint, client_id, client_secret, grant_type=client_credentials (+ optional scope, audience) |
| Custom headers | Any name/value pairs, sent on every request |
| Step | Action |
|---|---|
| 1 | Create Signing Secret; prepare separate testing + production URLs |
| 2 | Email registration to Technical Integrations |
| 3 | Validate test payloads in the testing environment |
| 4 | Confirm results; request production activation |
Full walkthrough: Onboarding & Registration