Know the moment it happens.

Register an endpoint and DecentroHR posts a signed event whenever something happens — a payroll run completes, a payslip is ready, an employee syncs. Delivery is a transactional outbox with automatic retries and exponential backoff, so events are never lost and never fired for rolled-back actions.

Events

Verifying signatures

Every delivery carries an X-DecentroHR-Signature header: sha256= plus the HMAC-SHA256 of the exact raw body, keyed by your endpoint secret. Verify it before acting on the event.

import { verifyWebhook } from "@decentrohr/sdk";

app.post("/hooks/decentrohr", (req, res) => {
  try {
    const evt = verifyWebhook(secret, req.rawBody, req.header("X-DecentroHR-Signature"));
    // evt.event === "payroll.run.completed", evt.tenantId, …
    res.sendStatus(200);
  } catch {
    res.sendStatus(400); // forged / bad signature
  }
});

Retries & redelivery

A non-2xx response is retried with backoff up to six attempts, then marked failed; you can redrive a failed delivery from the partner dashboard or API. Handle events idempotently — the same event id may arrive more than once.