Legacy Format Webhooks

Sites which have been upgraded from a legacy ExaVault account prior to 2025 may prefer to use webhook requests formatted like those sent by the legacy platform. Files.com provides two request encoding formats that produce requests designed to be compatible with legacy webhook listeners.

Creating New ExaVault Format Webhooks

Create a new webhook for a folder, either within the Folder Settings or from the Webhooks page, and change the Method setting for your webhook to POST, then change the Encoding to ExaVault legacy format (v1) or ExaVault legacy format (v2).

Webhook Signature Verification

Use X-Files-Signature-V2 to verify both new and existing EV1 and EV2 integrations. V2 uses HMAC-SHA256 with the webhook's Verification token as the key and the exact received JSON body bytes as the message. Its value is a bare 64-character lowercase hexadecimal digest, without a sha256= prefix. Verify the raw body before parsing it, using a constant-time comparison function, as shown in the receiver verification example.

V2 is available without changing the verification token or the EV1/EV2 payload format. Once your receiver uses V2, reject requests with a missing or invalid V2 signature rather than falling back to X-Exavault-Signature. The older MD5-based verification method is deprecated because MD5 is no longer considered secure. The EV1 and EV2 payload formats remain supported.

Deprecated ExaVault Signature

X-Exavault-Signature remains available for backward compatibility. To verify it in an existing receiver, concatenate the webhook's verification token followed by the exact received body bytes, with no separator, and calculate the lowercase hexadecimal MD5 digest. Compare that digest with X-Exavault-Signature using a constant-time comparison function.

Changes to whitespace, key order, or escaping change the signature even when the JSON data is the same. Obtain the original raw body before parsing; serializing a parsed object again does not preserve those bytes. The formatted examples below are for reading the payload structure, not for calculating the signature of a received request.

Each webhook uses its configured token for every request. If you regenerate that token, update the receiver to match. The legacy signature reference distinguishes this method from the older path-based folder webhook signature. None of these signatures establishes that a delivery is new or has not already been processed.

EV1 Legacy Format Request Structure

Messages for webhooks using EV1 legacy format contain a JSON-formatted string (not including extra whitespace or line breaks) with the following properties.

Here is a prettified version of a sample EV1 legacy format request, with added line breaks and whitespace for readability. The actual request body will not contain extra whitespace.

{
  "accountname": "testsite",
  "username": "bob.johnson@example.com",
  "operation": "Download",
  "protocol": "web",
  "path": "/Aboodabha/Pics_2.png",
  "sourcepath": null,
  "attempt": 1,
  "attemptId": "1df19v0v-1"
}

EV2 Legacy Format Request Structure

Messages for webhooks using EV2 legacy format contain a JSON-formatted string (not including extra whitespace or line breaks) with the following properties.

The eventData.resources object contains the following properties

The eventData.destinationResource object, which is only included for the resources.copy or resources.move event, contains the following properties.

Here is a prettified version of a sample EV2 legacy format request, with added line breaks and whitespace for readability. The request you receive will not contain any extra whitespace.

{
  "attemptId": "1dfj1pgm-1",
  "accountName": "testsite",
  "eventTimestamp": "2023-04-17T15:41:52-04:00",
  "ipAddress": "34.211.45.99",
  "protocol": "web",
  "username": "bob.johnson@example.com",
  "event": "resources.upload",
  "eventData": {
    "resources": {
      "id": 6541587968,
      "hash": "11111111111111111111111111111111",
      "name": "Files.docx",
      "extension": "docx",
      "type": "file",
      "createdBy": "bob.johnson@example.com",
      "uploadDate": "2023-04-17T15:41:52-04:00",
      "createdAt": "2023-04-17T15:41:52-04:00",
      "updatedAt": "2023-04-17T15:41:52-04:00",
      "accessedAt": null,
      "path": "/Uploads/Files.docx",
      "size": 14252,
      "fileCount": null,
      "previewable": true
    }
  }
}