Receive Webhooks
Webhooks are available on Growth and Enterprise. Instead of polling, Ducker posts to your endpoint when something happens.
Events
| Event | When |
|---|---|
invitation.sent | An invitation goes out |
attempt.started | A candidate starts and the timer begins |
attempt.submitted | A candidate submits |
attempt.abandoned | The time limit elapsed without a submission |
report.ready | Grading and review finished; the report is available |
report.ready is the one most integrations want.
Setting up an endpoint
Settings → Developer → Webhooks → Add endpoint. Give an HTTPS URL and select events. We show a signing secret once — store it.
Verifying the signature
Every request carries a signature header computed over the raw request body with your signing secret. Verify it before trusting the payload, and compare using a constant-time comparison.
Compute the signature over the raw body, before any JSON parsing. Re-serialising changes the bytes and the signature will not match.
Responding
Return a 2xx quickly — within a few seconds. Queue the work; do not do it inline.
Non-2xx responses and timeouts are retried with exponential backoff for up to 24 hours. After that the delivery is marked failed and visible in the endpoint's delivery log.
Idempotency
Retries mean you can receive the same event twice. Each delivery carries a unique event id — record it and ignore duplicates.
Testing
Every endpoint has a Send test event button, and the delivery log shows the request, your response, and the timing for the last 30 days.