Signed requests
HMAC-SHA256 over the timestamp and the raw body, sent as X-Tailride-Signature: v1=…, with the timestamp in X-Tailride-Timestamp so you can reject old or replayed requests.
Webhooks & API · Paid plans
Every processed invoice, sent to your own systems.
Tailride posts a signed JSON webhook the moment an invoice is processed or edited — vendor, amounts, VAT, line items and a link to the PDF. Search invoices over a REST API, or connect Zapier and Make without writing code.
What is the Tailride invoice webhook?
A webhook is an HTTP POST that Tailride sends to a URL you choose. There are two events: invoice.processed when a new invoice has been read, and invoice.updated when someone edits it, attaches a document or marks it paid. Every request is signed with HMAC-SHA256, retried when your server is unavailable and recorded in the invoice's activity log, so your ERP, data warehouse or approval flow gets the same data you see in the dashboard.
What your endpoint receives
The real request, headers and all
This is an invoice.processed delivery as Tailride sends it. invoice.updated carries the same invoice plus a list of what changed.
ERP synchttps://erp.example.com/hooks/tailride
Active- Event
- Invoice processed invoice.processed
- Signing secret
- whsec_••••••••••••3f9aCopy signing secretRotate signing secret
- Custom headers
- Authorization: Bearer ••••••
import crypto from "node:crypto";
export function isFromTailride(req, rawBody, secret) {
const ts = req.headers["x-tailride-timestamp"];
const sig = req.headers["x-tailride-signature"]?.replace("v1=", "") ?? "";
if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
const expected = crypto.createHmac("sha256", secret)
.update(`${ts}.${rawBody}`).digest("hex");
return sig.length === expected.length &&
crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
}curl "https://tailride.so/api/v1/invoices?search=northwind&limit=20" \
-H "X-Api-Key: trapi_…"POST /hooks/tailride HTTP/1.1
Content-Type: application/json
User-Agent: Tailride-Webhooks/1.0
X-Tailride-Event: invoice.processed
X-Tailride-Timestamp: 1792574400
X-Tailride-Signature: v1=5f2c8e…b41d
{
"event": "invoice.processed",
"timestamp": "2026-10-21T09:20:00.000Z",
"data": {
"invoice": {
"id": "6716f0c2e4b09a35d8f11a42",
"from": "billing@northwind.example",
"invoiceId": "INV-4471",
"invoiceDate": "2026-10-20T00:00:00.000Z",
"documentType": "invoice",
"amount": 1249,
"currency": "EUR",
"payment": { "status": "unpaid" },
"vendor": { "name": "Northwind Supplies GmbH", "countryCode": "DE", "taxId": "DE811234567" },
"items": [
{ "description": "Office chairs", "quantity": 2, "unitPrice": 524.79,
"taxRate": 19, "taxAmount": 199.42, "subtotal": 1049.58, "total": 1249 }
],
"tags": ["office"],
"attachment": { "url": "https://…/INV-4471.pdf", "expiresAt": "2026-10-22T09:20:00.000Z" }
}
}
}How it works
Five minutes in Settings, then every invoice arrives on its own.
01Add an endpoint
In Settings → Webhooks, enter a name and a URL, pick the event, and optionally add up to five custom headers — for example an API key your endpoint expects.
02Copy the signing secret
Each webhook gets its own whsec_ secret. Use it to check the X-Tailride-Signature header. Rotate it whenever you need to; the old one stops working at once.
03Receive invoices
When an invoice is processed or changed, Tailride POSTs JSON with the full invoice. Answer with any 2xx status within 10 seconds.
04Automate the rest
Write the data into your ERP, a database or an approval flow — or let the Tailride apps for Zapier and Make do it without code.
Built for production
Sensible retries
Up to three attempts with a 10-second timeout. Network errors, timeouts, 408, 429 and 5xx answers are retried; other 4xx answers count as a rejection. Use data.invoice.id to ignore a repeat.
The whole invoice
Vendor and VAT number, invoice number and dates, amount, currency, payment status, subscription details, tags and every line item with its tax rate — plus download links for the PDF and supporting documents.
Changes, not only new invoices
invoice.updated fires on edits, on supporting documents added or removed and on payment-status changes, with each changed field's previous and current value.
Locked down
Private and internal addresses are blocked, redirects are never followed, and the signing secret and custom header values are stored encrypted.
Visible on every invoice
Each delivery — and each failed one — appears in the invoice's activity log, so you can see what was sent where and when.
What teams build with it
- Post every processed invoice into an ERP or in-house tool that has no native Tailride integration.
- Load invoice and line-item data into a data warehouse for spend reporting.
- Start an approval in Slack or Microsoft Teams through Zapier or Make when an invoice above a set amount arrives.
- Update a CRM or project tool as soon as an invoice is marked paid.
Frequently asked questions
Which events can I subscribe to?
invoice.processed fires when a new document has been read and recognised as an invoice. invoice.updated fires when a processed invoice changes afterwards: edited fields, supporting documents attached or removed, a new payment status. Each webhook subscribes to one event, so add a second webhook to receive both.
How do I check that a request really comes from Tailride?
Compute HMAC-SHA256 of the X-Tailride-Timestamp value, a dot and the raw request body, using the webhook's whsec_ secret. Compare the hex result with the value after v1= in X-Tailride-Signature, and reject requests whose timestamp is more than a few minutes old.
What happens if my endpoint is down?
Tailride tries up to three times, a few seconds apart. Network errors, timeouts and 408, 429 or 5xx answers are retried; any other 4xx is treated as a rejection. If every attempt fails, the failure is shown in the invoice's activity log — use the API to fetch anything you missed.
What can the REST API do?
With a trapi_ API key you can read the account (GET /api/v1/me), search and page through processed invoices — up to 100 per page — with GET /api/v1/invoices, and subscribe Zapier or Make to invoice events. The base URL is https://tailride.so/api/v1; send the key as X-Api-Key or as a Bearer token.
Is there a Zapier or Make app?
Yes. The Zapier app is public: triggers for New Invoice and Updated Invoice, and a Find Invoice search. The Make app — watch new or updated invoices, search invoices, make an API call — is available by invitation; ask support for the link.
Which plans include webhooks and the API?
All paid plans, for business accounts. The account owner manages them in Settings → Webhooks: up to 10 webhooks and 10 API keys, plus the webhooks that Zapier and Make create for you.
How long do the file links stay valid?
Download links in a webhook work for 24 hours; links returned by the API work for one hour. Save the file on your side if you need to keep it.
Keep reading
Around webhooks and the API
The ready-made integrations, the developer docs, and where the invoices come from in the first place.
Send your invoices where your work happens
Webhooks, API keys and the Zapier app are included on every paid plan.
