Async

Webhooks & callbacks

The AI transform endpoints can deliver results asynchronously. Pass a callback_url and a request_id, and Dishora will POST the finished payload to your endpoint as a background task while the HTTP response returns immediately.

Which endpoints support callbacks

rewrite-tone, budgetify-recipe, healthify, adapt-method, and suggest-substitute on the AI service (https://ai.dishora.app/api/v1/*). POST /v1/recipes/generate on the REST API is synchronous and does not accept a callback_url: it returns the complete recipe in the response.

Request flow

async transform

curl https://ai.dishora.app/api/v1/healthify \
  -H "Authorization: Bearer $DISHORA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "recipe": { "title": "Butter Chicken", "ingredients": [ ... ], "instructions": [ ... ] },
    "health_focus": "highProtein",
    "callback_url": "https://yourapp.com/dishora/callback",
    "request_id": "job_8821"
  }'

The callback fires as soon as the model finishes. Your request_id is echoed back so you can correlate the delivery with the original job:

callback payload (POST to your callback_url)

{
  "type": "healthify",
  "request_id": "job_8821",
  "model_tier": "strong",
  "model": "anthropic/claude-3.5-sonnet",
  "data": {
    "name": "High-Protein Butter Chicken",
    "ingredients": [ ... ],
    "steps": [ ... ]
  },
  "timestamp": "2026-07-19T09:30:00+00:00"
}

Securing callbacks

Every callback carries the shared secret in the X-Callback-Secret header. Compare it against the secret from your dashboard using a constant-time comparison before trusting the payload, and always serve your endpoint over HTTPS.

verify (Node)

import crypto from "node:crypto";

function verify(headerSecret: string, expected: string) {
  const a = Buffer.from(headerSecret);
  const b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

Allow-listed hosts only

To prevent SSRF abuse, callbacks are only delivered to hosts registered with Dishora. Self-serve endpoint registration ships with the dashboard; until then, contact us to allow-list your domain (Scale tier).

Delivery semantics

Delivery is at-most-once: callbacks are fire-and-forget and are not retried. Respond with a 2xx quickly and process the payload asynchronously on your side. The synchronous HTTP response always contains the same result, so treat the callback as a convenience, not the only channel.