Webhooks

Receive real-time push notifications when orders complete or fail

Webhooks deliver HTTP POST callbacks to your server when order processing completes or fails. Use webhooks instead of polling the Get Order endpoint — your server gets notified the moment a result is ready.

Setting up webhooks

1. Register a webhook endpoint

   Create a webhook using the Create Webhook API:

   curl -X POST https://morimori.app/api/v2/orders/webhooks \
     -H "Authorization: Bearer YOUR_API_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{
       "name": "My Webhook",
       "url": "https://your-server.com/webhook"
     }'
   

   Response:

   {
     "data": {
       "id": 1,
       "name": "My Webhook",
       "secret": "whsec_xxxxxxxxxxxxxxxxxx"
     }
   }
   

   Save the secret immediately — it is shown only once and cannot be retrieved again. You need it to verify every incoming webhook signature.

2. Implement your endpoint

   Your webhook handler must:

   • Accept POST requests with a JSON body
   • Respond with a 2xx status code within 5 seconds
   • Verify the X-MoriBiz-Signature header before processing
3. Verify signatures

   Every request includes an X-MoriBiz-Signature header. See Signature Verification below for implementation in your language.

Event types

Event Type	Description
order.antiAi.completed	Anti-AI processing completed successfully
order.antiAi.failed	Anti-AI processing failed
order.watermarkEmbed.completed	Watermark embedding completed successfully
order.watermarkEmbed.failed	Watermark embedding failed
order.watermarkExtract.completed	Watermark extraction completed successfully
order.watermarkExtract.failed	Watermark extraction failed

Webhook payload

All webhook payloads follow this structure:

{
  "eventType": "order.antiAi.completed",
  "occurredAt": "2026-02-19T12:00:00.000Z",
  "data": {
    "orderId": "123456789",
    "orderName": "anti_ai_2026-02-19",
    "createdAt": "2026-02-19T11:50:00.000Z",
    "completedAt": "2026-02-19T12:00:00.000Z",
    "status": "complete",
    "fileCount": 3,
    "downloadUrl": "https://s3.amazonaws.com/..."
  }
}

Completed event data

Field	Type	Description
orderId	string	Order ID
orderName	string	Order name
createdAt	string	Order creation time (ISO 8601)
completedAt	string	Processing completion time (ISO 8601)
status	string	complete, detected, or undetected
fileCount	integer	Number of processed files
downloadUrl	string	Result file download URL (valid for 1 hour)

Failed event data

Field	Type	Description
orderId	string	Order ID
orderName	string	Order name
createdAt	string	Order creation time (ISO 8601)
failedAt	string	Processing failure time (ISO 8601)
status	string	Always failed
error.code	string	Error code
error.message	string	Error message

Watermark extract completed

For watermark extract orders, the completed event includes additional fields:

Field	Type	Description
status	string	detected or undetected
watermarkFound	boolean	Whether a watermark was detected
watermarkInfo.text	string	Detected watermark text (only when watermarkFound is true)

Signature verification

Verify webhook authenticity by checking the X-MoriBiz-Signature header. Always verify before processing the event.

Node.js

const crypto = require('crypto');

function verifyWebhookSignature(rawBody, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody)          // use the raw request body string
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// Express handler
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-moribiz-signature'];

  if (!verifyWebhookSignature(req.body.toString(), signature, process.env.WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  const { eventType, data } = JSON.parse(req.body);
  console.log(`Received ${eventType} for order ${data.orderId}`);
  res.sendStatus(200);
});

Retry policy

If your endpoint doesn’t return a 2xx status code, BIZ MORI retries the delivery:

Attempt	Delay
1st retry	1 second
2nd retry	2 seconds
3rd retry	4 seconds

After 3 failed retries, the event is marked as FAILED. You can view failed events using the List Webhook Events endpoint.

Managing webhooks

Action	Endpoint
List all webhooks	GET /webhooks
Create a webhook	POST /webhooks
Get webhook details	GET /webhooks/
Update a webhook	PUT /webhooks/
Delete a webhook	DELETE /webhooks/
View delivery events	GET /webhooks//events