A run started with an API key finished a turn

POSTyour webhook URLRush sends this

Sent to the webhook_url set on the API key that started the run (PATCH /o/{org}/api-keys/{key}), within about 30 seconds of a turn finishing: one per turn of a resumable run. Signed per Standard Webhooks with the key's whsec_ secret. Any 2xx within 5 seconds acknowledges it; anything else is retried 2, 4 and 6 minutes after the first attempt with the same webhook-id, then dropped. Revoking the key or clearing its webhook drops pending retries.

Headers

webhook-idstringrequired

Stable across retries: webhook:{run_id}:{completed_at ms}.

webhook-timestampstringrequired

Unix seconds of this attempt.

webhook-signaturestringrequired

v1,<base64 HMAC-SHA256 of "{webhook-id}.{webhook-timestamp}.{body}", keyed by the base64 bytes after whsec_>.

Payload

typestringrequired

One ofrun.completedrun.failedrun.cancelled

timestampstringrequired

When the turn finished.

Format date-time

dataobjectrequired

8 fields

run_idstringrequired

project_idstring | nullrequired

Format uuid

statusstringrequired

completed, needs_review, failed or cancelled.

resultobject | nullrequired

The turn's answer, as GET …/sessions/{session}/result returns it; null when there is none or it is over 16 KiB (read result_url).

3 fields

textstring | nulloptional

structuredanyoptional

The object output_schema asked for, when one was given.

schema_validboolean | nulloptional

total_cost_usdnumber | nullrequired

result_urlstringrequired

Format uri

events_urlstringrequired

Format uri

artifacts_urlstringrequired

Format uri

Your response

200Any 2xx acknowledges the delivery.

import { createHmac, timingSafeEqual } from "node:crypto";

// secret: the key's whsec_… webhook_secret. body: the raw request body, unparsed.
export function verify(secret: string, headers: Headers, body: string): boolean {
  const id = headers.get("webhook-id")!;
  const ts = headers.get("webhook-timestamp")!;
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false; // stale or replayed
  const key = Buffer.from(secret.slice("whsec_".length), "base64");
  const expected = createHmac("sha256", key).update(`${id}.${ts}.${body}`).digest();
  return (headers.get("webhook-signature") ?? "").split(" ").some((sig) => {
    const got = Buffer.from(sig.split(",")[1] ?? "", "base64");
    return sig.startsWith("v1,") && got.length === expected.length && timingSafeEqual(got, expected);
  });
}

Payload

{
  "type": "run.completed",
  "timestamp": "2026-10-06T15:09:03.000Z",
  "data": {
    "run_id": "3f9c2a71d04b8e65",
    "project_id": null,
    "status": "completed",
    "result": {
      "text": "Pinned the clock in checkout.spec.ts and opened PR 412.",
      "structured": null,
      "schema_valid": null
    },
    "total_cost_usd": 1.84,
    "result_url": "https://api.prix.dev/o/acme/p/_/sessions/3f9c2a71d04b8e65/result",
    "events_url": "https://api.prix.dev/o/acme/p/_/sessions/3f9c2a71d04b8e65/events",
    "artifacts_url": "https://api.prix.dev/o/acme/p/_/sessions/3f9c2a71d04b8e65/artifacts"
  }
}