Webhooks

Instead of polling for status changes, you can configure a webhook URL when creating a table. The API sends HTTP POST requests to your endpoint when events occur.

Configuring a webhook

Pass a webhook_url when creating a table.

curl -X POST "https://hub.banditshq.com/api/v1/tables" \
  -H "Authorization: Bearer lasso_..." \
  -H "Content-Type: application/json" \
  -d '{
    "schema_id": "schema_abc123",
    "name": "Product catalog",
    "file_ids": ["file_xyz"],
    "webhook_url": "https://your-server.com/webhooks/lasso"
  }'

await client.tables.create({
  schema_id: "schema_abc123",
  name: "Product catalog",
  file_ids: ["file_xyz"],
  webhook_url: "https://your-server.com/webhooks/lasso",
});

client.tables.create(
    schema_id="schema_abc123",
    name="Product catalog",
    file_ids=["file_xyz"],
    webhook_url="https://your-server.com/webhooks/lasso",
)

Webhook payload

Each delivery is a JSON POST request with the following structure.

{
  "event": "table.completed",
  "timestamp": "2025-03-12T14:30:00.000Z",
  "data": {
    "table_id": "tbl_abc123",
    "status": "completed",
    "total_rows": 42
  }
}

Headers

Every webhook request includes these headers:

Header	Description
`Content-Type`	Always `application/json`.
`X-Lasso-Event`	The event type (e.g., `table.completed`).
`X-Lasso-Delivery-Id`	A unique identifier for this delivery attempt.
`X-Lasso-Signature`	HMAC-SHA256 signature of the request body (if a secret is configured).

Verifying signatures

If you provide a webhook secret, the API signs each payload using HMAC-SHA256. The signature is sent in the X-Lasso-Signature header with a sha256= prefix.

import hmac
import hashlib

def verify_signature(payload: bytes, signature: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(
        secret.encode(), payload, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

Retry policy

If your endpoint does not respond with a 2xx status code within 10 seconds, the API retries with exponential backoff:

Attempt	Delay
1st retry	30 seconds
2nd retry	5 minutes
3rd retry	30 minutes

After 3 failed retries, the delivery is abandoned. You can check the table status via the API at any time.

Catalog and attribute webhooks

For catalog products and attribute dictionary changes, subscribe via Catalog Webhooks. Supported events:

Event	Description
`product.created`	A catalog product was created
`product.updated`	A catalog product was updated
`product.deleted`	A catalog product was deleted
`attribute.created`	An attribute dictionary entry was created
`attribute.updated`	An attribute was updated or renamed
`attribute.deleted`	An attribute was deleted

Attribute webhook payloads include attribute_id and the full attribute object in data.

Custom auth headers

You can include a custom authentication header on webhook deliveries by setting webhook_auth_header_name and webhook_auth_header_value in your table creation input data.

Overview

Search

Enrich

Tables

Rows

Enhance

Schemas

Attributes

Files

Glossary

Credits

Catalog

Catalog Webhooks

Configuring a webhook

Webhook payload

Headers

Verifying signatures

Retry policy

Catalog and attribute webhooks

Custom auth headers

​Configuring a webhook

​Webhook payload

​Headers

​Verifying signatures

​Retry policy

​Catalog and attribute webhooks

​Custom auth headers

Configuring a webhook

Webhook payload

Headers

Verifying signatures

Retry policy

Catalog and attribute webhooks

Custom auth headers