Fire any workflow off a Fotowall event.

What Fotowall webhooks do and how they work.

Seven events. Pick which ones fire per webhook URL.

Subscribe to all events or filter to just the ones you care about. Below is the canonical payload for each event type. All timestamps are ISO 8601 UTC.

{
  "event": "photo.uploaded",
  "eventId": "spring-gala-2026",
  "photo": {
    "id": "ph_8a92",
    "status": "pending",
    "url": "https://storage.googleapis.com/fotowall/.../ph_8a92.jpg",
    "uploaderName": "Maya",
    "uploaderEmail": "maya@example.com",
    "createdAt": "2026-05-17T03:14:00Z"
  }
}

{
  "event": "photo.approved",
  "eventId": "spring-gala-2026",
  "photo": {
    "id": "ph_8a92",
    "status": "approved",
    "url": "https://storage.googleapis.com/fotowall/.../ph_8a92.jpg",
    "uploaderName": "Maya",
    "approvedAt": "2026-05-17T03:14:42Z",
    "approvedBy": "admin@yourorg.com"
  }
}

{
  "event": "photo.rejected",
  "eventId": "spring-gala-2026",
  "photo": {
    "id": "ph_8a92",
    "status": "rejected",
    "uploaderName": "Maya",
    "rejectedAt": "2026-05-17T03:14:18Z",
    "rejectedBy": "admin@yourorg.com",
    "reason": "duplicate"
  }
}

{
  "event": "event.published",
  "eventId": "spring-gala-2026",
  "eventName": "Spring Gala 2026",
  "template": "gala",
  "publishedAt": "2026-05-17T18:00:00Z",
  "galleryUrl": "https://app.fotowall.io/gallery.html?event=spring-gala-2026"
}

{
  "event": "event.archived",
  "eventId": "spring-gala-2026",
  "archivedAt": "2026-05-18T08:00:00Z",
  "photoCount": 742
}

{
  "event": "milestone.reached",
  "eventId": "spring-gala-2026",
  "milestone": 500,
  "reachedAt": "2026-05-17T21:34:11Z",
  "latestPhoto": {
    "id": "ph_500x",
    "uploaderName": "Marcus"
  }
}

{
  "event": "guest.joined",
  "eventId": "spring-gala-2026",
  "uploaderName": "Marcus",
  "uploaderEmail": "marcus@example.com",
  "firstPhotoId": "ph_500x",
  "joinedAt": "2026-05-17T21:34:11Z"
}

Verify before you trust.

The Fotowall-Signature header looks like t=1715000000,v1=ab12.... Concatenate the timestamp + "." + raw body, HMAC-SHA256 with your event's webhook secret, compare in constant time, and reject if the timestamp is older than 5 minutes.

Node.js (Express)

import crypto from 'node:crypto';

const SECRET = process.env.FOTOWALL_WEBHOOK_SECRET!;

app.post('/webhooks/fotowall', express.raw({ type: 'application/json' }), (req, res) => {
  const header = req.header('Fotowall-Signature') ?? '';
  const parts = Object.fromEntries(header.split(',').map(p => p.split('=')));

  const t  = parts.t;
  const v1 = parts.v1;
  if (!t || !v1) return res.status(400).send('missing signature');

  // Replay defense — reject anything older than 5 minutes.
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) {
    return res.status(400).send('stale');
  }

  const signed   = `${t}.${req.body.toString('utf8')}`;
  const expected = crypto.createHmac('sha256', SECRET).update(signed).digest('hex');

  // Constant-time comparison.
  const a = Buffer.from(expected, 'hex');
  const b = Buffer.from(v1, 'hex');
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.status(401).send('bad signature');
  }

  const payload = JSON.parse(req.body.toString('utf8'));
  // ... process payload, return 200 fast, do work async ...
  res.status(200).end();
});

Python (Flask)

import hmac, hashlib, time, os
from flask import request, abort

SECRET = os.environ['FOTOWALL_WEBHOOK_SECRET'].encode()

@app.post('/webhooks/fotowall')
def fotowall():
    header = request.headers.get('Fotowall-Signature', '')
    parts  = dict(p.split('=', 1) for p in header.split(','))
    t, v1  = parts.get('t'), parts.get('v1')
    if not t or not v1:
        abort(400)

    if abs(time.time() - int(t)) > 300:
        abort(400)

    signed   = f"{t}.{request.get_data(as_text=True)}".encode()
    expected = hmac.new(SECRET, signed, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, v1):
        abort(401)

    payload = request.get_json(force=True)
    # ... handle, return 200, queue work async ...
    return '', 200

Roll your own dry-run with curl.

The admin "Send test" button is the easy path. For full-control replays — and for unit-testing your endpoint — generate a signed request yourself.

Generate a signature with openssl + curl

SECRET="whsec_your_event_secret"
BODY='{"event":"photo.uploaded","eventId":"spring-gala-2026","photo":{"id":"ph_test"}}'
T=$(date +%s)
SIG=$(printf "%s.%s" "$T" "$BODY" | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $2}')

curl -X POST https://your.app/webhooks/fotowall \
  -H "Content-Type: application/json" \
  -H "Fotowall-Event-Type: photo.uploaded" \
  -H "Fotowall-Event-Id: spring-gala-2026" \
  -H "Fotowall-Delivery-Id: del_$(uuidgen)" \
  -H "Fotowall-Signature: t=$T,v1=$SIG" \
  -H "User-Agent: Fotowall-Webhooks/1.0" \
  --data "$BODY"

Questions we get every week.