# Webhooks

Webhooks notify your system of events in Dyflexis without polling. They invert the direction of the API: Dyflexis sends an HTTP `POST` request to a URL **you** host, with the payload documented per event in the API reference.

## Registering a receiver

Webhooks cannot be registered through the API. Ask Dyflexis to register your receiver URL, or configure it in Dyflexis where your subscription allows it.

## Available events

| Event | Sent when |
|  --- | --- |
| Payroll period ready | A payroll period is finalised and its hours are ready to be picked up |
| Sick leave registration | A sick-leave registration is created or the employee recovers |
| Time card | A time card is available for an employment-agency (SETU) integration |


The exact payload of each event is documented in the **Webhooks** section of the [API reference](/openapi).

The sick-leave event wraps its payload in an envelope; use the envelope field `type` to determine which event you received (`sick_leave_created` or `sick_leave_recovered`).

## What your receiver must do

- Accept an HTTP `POST` with a JSON body (XML for the SETU time card) at the registered URL.
- Respond `200 OK` once the message is accepted. Respond `503 Service Unavailable` when your system is temporarily unable to process it.
- Treat the request as a notification: validate, store, and acknowledge quickly, then process asynchronously.


Dyflexis does not authenticate to your receiver with your Dyflexis API key, so do not reuse that key to protect your endpoint. Use an unguessable URL and verify the payload against the documented schema.