Webhook event

POST

{your endpoint URL}

Plan: Business
Auth: HMAC signature header
Parameters: None
Returns: Your 2xx, within 10 s

Every event reaches each matching endpoint in a request of its own.

For every live fixture your filters match you receive fixture.score (one side’s current score changed) and fixture.status (the match kicked off, entered a new period or a break, reached full time, or was postponed or canceled).

Two more types are delivered only for fixtures named in the endpoint’s fixture ids: fixture.events, when match events are added, corrected or removed (goals with their scorers, cards, substitutions), and fixture.lineups, from roughly 90 minutes ahead of kick-off — the official lineups, which usually come out an hour before, plus any changes during play. ping is a test event you trigger in the dashboard.

data.changes holds a partial Fixture, shaped exactly like a WebSocket delta.

Worth knowing

Check the signature on every request.
DSA-Signature has the form t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<raw body>"> and is computed with the endpoint’s signing secret, which you see a single time, at creation or rotation.
Use a constant-time comparison for signatures and refuse any t more than a few minutes old.
Answer with a 2xx within 10 seconds.
Anything else, redirects too, triggers retries after 10 s, 1 min, 5 min, 30 min, 2 h and 6 h; then the delivery is marked failed.
If every attempt to an endpoint fails for 24 hours, the endpoint is disabled until you re-enable it in the dashboard.
Delivery order is not guaranteed, so deduplicate with createdAt and the event id (also sent as DSA-Event-Id).
Endpoints must be public https:// hosts.

01Example delivery

HTTP · JSON · Node

14 lines

POST https://your-server.example.com/datasportsapi
DSA-Signature: t=1793551606,v1=5f0c…
DSA-Event: fixture.score
DSA-Event-Id: evt_8a1f…
Content-Type: application/json

{ "id": "evt_8a1f…", "type": "fixture.score", "createdAt": "2026-11-01T16:46:46.208Z",
  "data": { "fixtureId": 211521, "sport": "football", "leagueId": 17,
            "changes": { "homeScore": { "current": 1, "periods": { "period1": 1 } } } } }

// Node: verify the signature
const [t, v1] = header.split(',').map((p) => p.split('=')[1]);
const expected = crypto.createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex');
const ok = crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected)) && Date.now() / 1000 - Number(t) < 300;