Webhook Event Reference

Arqam360 sends each webhook as a POST request with a JSON body to the endpoints you add under Tags & Pixels → Webhooks. Every request carries two headers: X-ConsentIQ-Event, the event name, and X-ConsentIQ-Signature, in the form t=<timestamp>,v1=<signature>. The signature is a hex HMAC-SHA256 of the timestamp, a dot, and the JSON of the data object, keyed with the endpoint's signing secret. The secret is shown once, when you create the endpoint, and you can rotate it at any time.

Events and payload fields

• consent.created — sent each time a visitor's consent choice is recorded: accepting, rejecting or saving preferences. A visitor who changes their choice later creates a new record and a new event.
• data.recordId — the consent record's ID; the same ID appears in your consent data export
• data.domain — the site where the choice was made
• data.consent — true or false for necessary, analytics, marketing, functional and preferences
• data.anonymousId — the anonymous visitor ID set by the banner
• data.country — two-letter country code of the visitor, when it could be determined
• data.gpcDetected — true when the visitor's browser sent a Global Privacy Control signal
• data.timestamp — when the choice was made (ISO 8601, UTC)

Example request

POST https://your-server.example/webhooks/arqam360
Content-Type: application/json
X-ConsentIQ-Event: consent.created
X-ConsentIQ-Signature: t=1790000000000,v1=<hex HMAC-SHA256>

{
  "event": "consent.created",
  "timestamp": 1790000000000,
  "data": {
    "recordId": "66f0c2a1e4b0a1b2c3d4e5f6",
    "domain": "yourstore.com",
    "consent": {
      "necessary": true,
      "analytics": true,
      "marketing": false,
      "functional": false,
      "preferences": false
    },
    "anonymousId": "a1b2c3d4-...",
    "country": "SA",
    "gpcDetected": false,
    "timestamp": "2026-09-21T14:13:20.000Z"
  }
}

// Verify: v1 = HMAC-SHA256(secret, t + "." + JSON.stringify(body.data)), hex

Delivery and retries

A delivery succeeds when your endpoint answers with a 2xx status within 10 seconds. Anything else is retried, up to 5 attempts in total, with waits of about 1, 2, 4 and 8 minutes between attempts. Each failed attempt counts against the endpoint, and after 10 failed attempts in a row the endpoint is switched off automatically. A successful delivery resets the count, and so does switching the endpoint back on in the dashboard.