Webhooks

Pass webhook when you create a crawl. Sila sends no events for crawls without it. Find your signing secret (whsec_…) on the Webhooks page.

Event types

crawl.started, crawl.discovered, crawl.page_batch, crawl.completed, crawl.failed, crawl.canceled.

Body

{
  "id": "evt_…",
  "type": "crawl.page_batch",
  "createdAt": "2026-11-04T00:00:00.000Z",
  "data": { "crawlId": "…", "status": "running", "phase": "crawling", "pagesStored": 50, "cursor": 1 },
  "metadata": {}
}

metadata echoes what you sent in webhook.metadata. data.cursor is the number of page batches stored so far: when it is higher than the last nextCursor you read, call crawl pages with your nextCursor to fetch the new batches.

Signature

Each request has the header:

Sila-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256>

The HMAC key is your signing secret. The signed message is <t>.<raw body>. Reject requests more than 300 seconds old.

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifySilaSignature(rawBody, header, secret, nowSec = Math.floor(Date.now() / 1000)) {
  const parts = Object.fromEntries((header ?? "").split(",").map((p) => p.split("=")));
  const t = Number(parts.t);
  if (!parts.v1 || !Number.isFinite(t) || Math.abs(nowSec - t) > 300) return false;
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(parts.v1);
  return a.length === b.length && timingSafeEqual(a, b);
}

Verify against the raw body, not re-serialized JSON.

Delivery

Return any 2xx quickly. Sila retries failed deliveries with growing delays, up to 8 attempts. Events can arrive more than once; dedupe on id.

Getting started

API reference

Guides

Event types

Body

Signature

Delivery

​Event types

​Body

​Signature

​Delivery

Event types

Body

Signature

Delivery