Webhooks

With the Live plan, webhooks push changes in matches in play to your server as they happen: the score, the period, every try, kick and card, and the match clock. No polling.

Add one

curl -X POST https://api.rugbyapi.com/v1/webhooks \
  -H "Authorization: Bearer rug_live_..." \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/rugby", "events": ["match.event", "match.finished"]}'

The answer holds the webhook's id and its secret. Leave events out to get them all. An account can have up to five; Your webhooks lists them with their delivery state, and Delete a webhook removes one.

Events

Event	Sent when
match.clock	The clock starts, stops or is corrected.
match.period	A half starts or ends.
match.event	A try, conversion, penalty goal, drop goal or card.
match.event_removed	An event is taken back, for example a try ruled out.
match.finished	Full time, with the final score.

Check the signature

Each post carries X-RugbyAPI-Signature: t=<unix time>,v1=<hex>, where v1 is the HMAC-SHA256 of the time, a full stop and the raw body, keyed with your secret. Work it out and compare before trusting the post:

$sig = $_SERVER['HTTP_X_RUGBYAPI_SIGNATURE'];
parse_str(str_replace(',', '&', $sig), $p);
$ok = hash_equals(hash_hmac('sha256', $p['t'] . '.' . file_get_contents('php://input'), $secret), $p['v1']);

Delivery

Answer with any 2xx within a few seconds. A post that fails is tried again after 1, 5 and 30 minutes, then 2 and 6 hours. After 200 failures in a row the webhook is paused, and Your webhooks shows it.

The clock

The clock comes as a point to count on from: running, elapsed_s and at_utc. While it runs, the clock now is elapsed_s plus the seconds since at_utc, so your app can show minutes and seconds between updates. Matches we collect are read every two minutes while in play, to the minute. Live matches lists the fixtures of the next seven days we follow.