Webhook setup checklist — what your gateway must send

When you create a webhook data source the platform generates two things you must paste into your gateway: a webhook URL and a webhook secret. The secret is shown only once — store it before leaving the page.

Every webhook request must include three things

The body — JSON with a "readings" array. Each reading has a timestamp (ISO 8601 UTC), a point_id (any stable string that identifies the meter — typically the meter serial number), and a "values" object with at least one numeric value.
X-Webhook-Timestamp header — Unix epoch seconds at the moment of sending (NOT the meter reading timestamp; the wall-clock time of the request). Used to reject replayed payloads. Requests where this differs from server time by more than 5 minutes are rejected.
X-Webhook-Signature header — value is "sha256=" followed by the hex HMAC-SHA256 of the string "<timestamp>.<body>" signed with the webhook secret. The timestamp here is the same value you sent in X-Webhook-Timestamp.

The signing string is the literal concatenation: the epoch seconds, then a single period, then the raw JSON body bytes. Most gateway scripting environments (Node-RED, RutOS Data-to-Server with template, Python micro-scripts) can produce this in three lines.

Minimal valid payload

{"readings":[{"timestamp":"2026-05-22T14:00:00Z","point_id":"meter-001","values":{"kwh":12345.6,"unit":"kWh"}}]}

Where to check: Analytics → Data Import → your webhook source → the helper text under the URL field describes the required headers. If signing logic is unclear, that's a vendor-side question for whoever set up the gateway script.