PLATFORM API Live

Inbound and outbound webhooks

Accept authenticated integration events and deliver signed Oddessy events to public HTTPS destinations.

Last updated 27 July 2026 · Documentation version 2026.07

Both directions are live

Inbound integrations authenticate events sent into Oddessy. Outbound destinations use a separate KMS-encrypted HMAC secret to sign events Oddessy sends to your public HTTPS receiver.

Oddessy signed inbound webhook and read-only MCP paths for local devices, LoRaWAN, no-code workflows, agents and existing HTTPS systems — Inbound authentication and outbound signing use separate credentials and bounded tenant-scoped contracts.

Authentication

Platform shows the credential only when the integration is created or rotated. Oddessy stores only its SHA-256 digest. Send it as a bearer token, or use Basic authentication with username oddessy and the secret as password.

Authorization: Bearer odd_wh_...

The Things Stack

Set the webhook base URL to https://platform.oddessy.io/api/webhooks/{integrationId} and the uplink message path to /uplink. Decoded payload, frame counters and bounded gateway RSSI/SNR metadata are normalized.

Generic JSON

curl -X POST "https://platform.oddessy.io/api/webhooks/int_..."   -H "Authorization: Bearer $ODDESSY_WEBHOOK_SECRET"   -H "Content-Type: application/json"   -d '{"device_id":"sensor-01","event_type":"reading","data":{"temperature":21.5}}'

No-code setup

In n8n use an HTTP Request node; in Zapier use a Webhooks action; in Make use an HTTP/Webhooks module. Select POST, paste the generated endpoint, set Content-Type: application/json, and use bearer authentication with the shown-once odd_wh_ secret. Platform's Send a safe test event button proves the Oddessy side before you troubleshoot field mapping.

Agent-originated events

OpenClaw hooks, TaskFlows and other LLM workflows can call the same signed JSON endpoint. Keep the payload factual and structured; do not send free-form model text as a PLC address, approval or evidence of physical state.

{
  "device_id": "agent-workflow-01",
  "event_type": "agent.observation",
  "data": {
    "summary": "Inspection review requested",
    "source_record": "case-1842"
  }
}

Payloads are capped at 128 KB. Integration and discovered-device views are tenant scoped. Normalized events expire after 30 days.

Outbound signed delivery

Add a destination under Platform → Integrations → Signed event destinations. Oddessy accepts only public HTTPS receivers on port 443, blocks redirects and non-public addresses, and shows the odd_out_ signing secret once.

Webhook-Id: odl_...
Webhook-Timestamp: 1785153600
Webhook-Signature: v1,<base64 HMAC-SHA256>
X-Oddessy-Event: alert.transition

Verify HMAC-SHA256 over Webhook-Id + "." + Webhook-Timestamp + "." + rawBody before parsing. Reject stale timestamps and deduplicate by Webhook-Id. Available families cover test, IoT event, determination, alert, device-status and OTA-status transitions.

Delivery is asynchronous and capped at five attempts. Exhausted messages enter a retained dead-letter queue; response status, attempts, latency and bounded errors remain visible for 30 days without retaining the signing secret or exposing payloads through MCP.