callback_url on /v1/videos: the Sume job envelope that arrives

Add callback_url (HTTPS only) to a POST /v1/videos body and Sume posts to it when the job reaches a terminal state. The payload is Sume's standard job envelope with event set to job.completed, job.failed or job.canceled, not OpenRouter's video.generation.* events, and the signature header is x-sume-webhook-signature, not X-OpenRouter-Signature.

If you ported a receiver from OpenRouter, the route and the verification both need a change. Events are terminal-only: there are no progress or partial deliveries. Sume retries non-2xx responses and network errors up to 10 attempts in total, with a fixed delay (30 s by default) and a 10-second timeout for each attempt, so return a 2xx quickly after you store the event and use job_id to drop duplicates.

Submit

The callback must be a public HTTPS URL. Localhost, private-network and non-HTTPS URLs are rejected.

curl -X POST https://api.sume.com/v1/videos \
  -H "Authorization: Bearer $SUME_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: promo-0042" \
  -d '{
    "model": "wan-3.0",
    "prompt": "Fireworks over a harbor, slow pan",
    "duration": 8,
    "resolution": "720p",
    "callback_url": "https://hooks.example.com/sume"
  }'

What arrives

A completed job looks like this; failed and canceled ones use status: "ERROR" and add an error object.

Receiver checklist

• Verify sume-v1 (HMAC SHA-256) over <timestamp>.<raw_body> using x-sume-webhook-timestamp and reject a timestamp outside your tolerance (the docs suggest five minutes), then parse. Refuse to run if your signing secret is empty.
• Store the media.sume.com artifact URL from payload.artifacts[].
• Keep the poll on GET /v1/videos/{id} or /v1/jobs/{id}/status as a backup for deliveries that never land.
• A 10-second 720p Wan 3.0 clip reserves $1.25 at submit, whichever way you learn the result.

Test the path before launch

The dashboard Webhooks tab and POST /v1/webhooks/test-deliveries (scope account:write) send a signed dummy webhook.test event to a URL you type. It never replays a real job, so it is the safe way to prove that your endpoint, signature check and 2xx response all work. Once that passes, run one real job and compare the stored job_id with the one the submit returned.

If a delivery is missing, redeliver it with POST /v1/jobs/{job_id}/webhook/redeliver, or read the job from its status URL. Neither changes the destination: a new callback URL means a new job.