Skip to main content
Webhooks deliver HTTP POST callbacks to your server when order processing completes or fails. Use webhooks instead of polling the Get Order endpoint — your server gets notified the moment a result is ready.

​
Setting up webhooks

1

Register a webhook endpoint

Create a webhook using the Create Webhook API:
curl -X POST https://morimori.app/api/v2/orders/webhooks \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "My Webhook",
    "url": "https://your-server.com/webhook"
  }'
Response:
{
  "data": {
    "id": 1,
    "name": "My Webhook",
    "secret": "whsec_xxxxxxxxxxxxxxxxxx"
  }
}
Save the secret immediately — it is shown only once and cannot be retrieved again. You need it to verify every incoming webhook signature.
2

Implement your endpoint

Your webhook handler must:
  • Accept POST requests with a JSON body
  • Respond with a 2xx status code within 5 seconds
  • Verify the X-MoriBiz-Signature header before processing
3

Verify signatures

Every request includes an X-MoriBiz-Signature header. See Signature Verification below for implementation in your language.

​
Event types

Event TypeDescription
order.antiAi.completedAnti-AI processing completed successfully
order.antiAi.failedAnti-AI processing failed
order.watermarkEmbed.completedWatermark embedding completed successfully
order.watermarkEmbed.failedWatermark embedding failed
order.watermarkExtract.completedWatermark extraction completed successfully
order.watermarkExtract.failedWatermark extraction failed

​
Webhook payload

All webhook payloads follow this structure: 
{
  "eventType": "order.antiAi.completed",
  "occurredAt": "2026-02-19T12:00:00.000Z",
  "data": {
    "orderId": "123456789",
    "orderName": "anti_ai_2026-02-19",
    "createdAt": "2026-02-19T11:50:00.000Z",
    "completedAt": "2026-02-19T12:00:00.000Z",
    "status": "complete",
    "fileCount": 3,
    "downloadUrl": "https://s3.amazonaws.com/..."
  }
}

​
Completed event data

FieldTypeDescription
orderIdstringOrder ID
orderNamestringOrder name
createdAtstringOrder creation time (ISO 8601)
completedAtstringProcessing completion time (ISO 8601)
statusstringcomplete, detected, or undetected
fileCountintegerNumber of processed files
downloadUrlstringResult file download URL (valid for 1 hour)

​
Failed event data

FieldTypeDescription
orderIdstringOrder ID
orderNamestringOrder name
createdAtstringOrder creation time (ISO 8601)
failedAtstringProcessing failure time (ISO 8601)
statusstringAlways failed
error.codestringError code
error.messagestringError message

​
Watermark extract completed

For watermark extract orders, the completed event includes additional fields:
FieldTypeDescription
statusstringdetected or undetected
watermarkFoundbooleanWhether a watermark was detected
watermarkInfo.textstringDetected watermark text (only when watermarkFound is true)

​
Signature verification

Verify webhook authenticity by checking the X-MoriBiz-Signature header. Always verify before processing the event. 
const crypto = require('crypto');

function verifyWebhookSignature(rawBody, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody)          // use the raw request body string
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// Express handler
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-moribiz-signature'];

  if (!verifyWebhookSignature(req.body.toString(), signature, process.env.WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  const { eventType, data } = JSON.parse(req.body);
  console.log(`Received ${eventType} for order ${data.orderId}`);
  res.sendStatus(200);
});

​
Retry policy

If your endpoint doesn’t return a 2xx status code, BIZ MORI retries the delivery:
AttemptDelay
1st retry1 second
2nd retry2 seconds
3rd retry4 seconds
After 3 failed retries, the event is marked as FAILED. You can view failed events using the List Webhook Events endpoint.

​
Managing webhooks

ActionEndpoint
List all webhooksGET /webhooks
Create a webhookPOST /webhooks
Get webhook detailsGET /webhooks/
Update a webhookPUT /webhooks/
Delete a webhookDELETE /webhooks/
View delivery eventsGET /webhooks//events