Property Change Alerts API

Each event is a JSON POST with these headers, following the Standard Webhooks scheme:

Example event

{
  "id": "EVENT_UUID",
  "type": "sale.recorded",
  "timestamp": "2026-10-27T05:12:44.000Z",
  "data": {
    "uprn": "100000000001",
    "watch": { "id": "WATCH_UUID", "label": "Portfolio ref 12" },
    "occurredAt": "2026-09-18T00:00:00.000Z",
    "transactionId": "4E1A0F53-0000-4C1B-8E3A-000000000001",
    "price": 385000,
    "transactionDate": "2026-09-18",
    "propertyType": "terraced",
    "newBuild": false,
    "tenure": "freehold",
    "category": "A",
    "address": { "saon": null, "paon": "12", "street": "EXAMPLE STREET", "town": "EXAMPLETON", "postcode": "EX1 2AB" },
    "match": { "method": "address", "watchedAddress": "12 EXAMPLE STREET, EXAMPLETON, EX1 2AB" }
  }
}

ownership.changed data has change, titleNumber, tenure, propertyAddress, proprietors, previousProprietors, dateProprietorAdded and pricePaid. epc.lodged data has certificateNumber, lodgedAt, inspectionDate, rating and previousCertificateNumber. address.changed data has address, postcode, previousAddress and previousPostcode.

Verify the signature (Node.js)

import crypto from 'node:crypto'

// rawBody must be the exact request body string, before JSON parsing.
export function verifyPropertyAlert(secret, headers, rawBody) {
  const id = headers['webhook-id']
  const timestamp = headers['webhook-timestamp']
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false

  const key = Buffer.from(secret.replace(/^whsec_/, ''), 'base64')
  const expected = 'v1,' + crypto.createHmac('sha256', key)
    .update(id + '.' + timestamp + '.' + rawBody)
    .digest('base64')

  return String(headers['webhook-signature']).split(' ').some(signature =>
    signature.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected)))
}

Retries

Any 2xx response within 10 seconds counts as delivered. Redirects are not followed. Other responses and timeouts are retried after 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours, 12 hours, 24 hours and 24 hours, about 3 days in total. A webhook that keeps failing for 3 days without a successful delivery, or that answers 410 Gone, is disabled; delete it and register it again once it is fixed. Events stay available from GET /api/v1/watches/events, so you can catch up on anything a webhook missed.