Developer Documentation

Webhooks LIVE

Subscribe to school events and receive HTTP POST callbacks when they occur. Set up endpoints from your dashboard at Settings → Developer (available on the Enterprise plan). Every delivery is signed with HMAC-SHA256 so you can verify it came from us.

Events available today

• student.enrolled — A new student was enrolled
• result.published — Academic results were published
• payment.received — A fee payment was received and matched

More events are added as new modules ship — tell us which ones you need at hey@lodumai.com.

Delivery payload

{
  "event": "student.enrolled",
  "timestamp": "2026-06-11T14:30:00Z",
  "payload": {
    "studentId": "a1b2c3d4-…",
    "name": "Amara Okonkwo"
  }
}

Verifying the signature

Each request carries an x-obara-signature header — the hex HMAC-SHA256 of the raw JSON body, keyed with the webhook secret shown when you created the endpoint:

const crypto = require('crypto')
const expected = crypto.createHmac('sha256', WEBHOOK_SECRET)
  .update(rawBody)
  .digest('hex')
const valid = expected === req.headers['x-obara-signature']

Delivery & retry

Deliveries are HTTP POST with a 5-second timeout. A failed delivery is retried once; design your handler to be idempotent and return 2xx quickly. You can fire a test delivery to any endpoint from Settings → Developer.

API keys LIVE

Generate and manage API keys from Settings → Developer. Keys are shown once at creation — store them securely. Today, keys identify your integration for webhooks; when the REST API launches, the same keys will authenticate your requests.

sk_live_0123abcd…   ← shown once, then stored hashed

REST API COMING SOON

Planned authentication

curl -H "Authorization: Bearer sk_live_YOUR_API_KEY" \
  https://api.obara.app/v1/students

Planned endpoints

Planned response envelope

Responses will use the same envelope the platform uses internally:

{ "success": true,  "data": { … } }
{ "success": false, "error": { "code": "VALIDATION_ERROR", "message": "…" } }