> ## Documentation Index
> Fetch the complete documentation index at: https://docs.warmr.so/llms.txt
> Use this file to discover all available pages before exploring further.

# A warmr event delivered to your configured endpoint

> Warmr POSTs a signed JSON body to your URL. Verify with
`X-Warmr-Signature: sha256=<hmac-sha256(rawBody, secret)>`. Delivery is
at-least-once; dedupe on `X-Warmr-Event-Id`. Retries: up to 5 attempts over 72h.

Compute the HMAC over the RAW request body (not a re-serialized object) using the signing
secret returned once when you created the webhook, then compare in constant time:

```js
import crypto from "node:crypto";
// The SDK ships this as verifyWebhookSignature(rawBody, header, secret).
function verify(rawBody, header, secret) {
  const expected = "sha256=" + crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(header ?? ""), b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}
```




## OpenAPI

````yaml /api/openapi.yaml webhook warmrEvent
openapi: 3.1.0
info:
  title: Warmr Cloud API
  version: '1.2'
  summary: Enqueue and read iPhone-fleet automation work (warmups + posts).
  description: >
    The business-facing REST surface for Warmr. **Bring-your-own-fleet**: API
    keys

    *enqueue* work and read org-scoped state; your own connected iPhones
    *execute* it.

    A server-side **airlock** prevents an API session from ever driving a
    device.


    Auth is a two-step flow: exchange a `wk_live_` API key at the exchange
    endpoint for a

    short-lived org session, then call `/v1` with `Authorization: Bearer
    <access_token>`.


    Every `/v1` response is wrapped in an envelope `{ "schema": "1.0", ... }`;
    errors are

    `{ "schema": "1.0", "error": { "code", "message", "data"? } }`. The exchange
    endpoint

    uses a flatter `{ "error": "<code>" }` body.


    NOTE: the public base URL is deployment-specific and is NOT asserted here.
    Replace the

    `app.warmr.so` / `<project-ref>` placeholders below with your deployment's
    values.
  license:
    name: UNLICENSED
servers:
  - url: https://{origin}
    description: Substitute your Warmr deployment origin. app.warmr.so is a placeholder.
    variables:
      origin:
        default: app.warmr.so
        description: Your Warmr deployment host, no scheme, e.g. app.example.com
security:
  - bearerAuth: []
tags:
  - name: auth
    description: Exchange an API key for an org session.
  - name: runs
    description: >-
      Enqueue and read units of automation work (warm_up or post); your
      connected iPhones execute them.
  - name: schedules
    description: >-
      Standing recurring post schedules (one account each). The materializer
      turns them into runs.
  - name: accounts
    description: Register and list the social account handles in your org.
  - name: content
    description: >-
      Signed direct-to-storage uploads for post clips (issue → upload →
      confirm).
  - name: usage
    description: Org storage and run counts for a billing period.
  - name: devices
    description: The iPhones your runner(s) have reported to the org.
  - name: webhooks
    description: >-
      Subscribe to run.completed / run.failed events and manage deliveries.
      Opt-in, secret-bearing (webhooks:read / webhooks:write).
  - name: keys
    description: >-
      List your org's API keys — metadata only, the secret is never returned.
      Opt-in keys:read.
  - name: health
    description: Lightweight org-scoped readiness probe. Opt-in health:read.
paths: {}
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: The access_token from the exchange endpoint.

````