Add webhook documentation

docs/docs/api/routes/clients.md

@@ -2,7 +2,7 @@
 
 These endpoints relate to managing your Tachi API clients, such as creating new ones or deleting them.
 
-For a detailed explaination on how to use the OAuth2 flow, you can check [Using OAuth2 With Tachi](../../tachi-server/infrastructure/oauth2.md)
+For a detailed explaination on how to use the OAuth2 flow, you can check [Using OAuth2 With Tachi](../../tachi-server/infrastructure/oauth2.md).
 
 *****
 

docs/docs/api/webhooks/main.md

@@ -0,0 +1,33 @@
+# About Webhooks
+
+Tachi supports webhooks. You can set a `webhookUri` as part of your
+[Tachi API Client](../routes/clients.md).
+
+## Usage and Security
+
+When a given event happens on Tachi, your webhookUri will recieve a POST
+request with some content and the type of event.
+
+You **MUST** validate that this request was from Tachi! Otherwise, anyone
+could post fake data to your webhook URI and potentially compromise it.
+
+To secure your webhook implementation, Tachi will send an Authorization header with `Bearer CLIENT_SECRET`. You should check that that value aligns with your client secret. If it doesn't, someone might be trying to perform an attack!
+
+## Data Format
+
+Data is sent as follows:
+
+```json
+{
+	"type": "EVENT_TYPE",
+	"content": {} // Content specific to that EVENT_TYPE!
+}
+```
+
+The current Events are:
+
+| Type | Description |
+| :: | :: |
+| `class-update/v1` | Fires whenever a user has had a class update positively, such as going from 9th Dan to 10th Dan. |
+| `goal-achieved/v1` | Fires whenever a user has achieved a goal. |
+| `milestone-achieved/v1` | Fires whenever a user has achieved a milestone. |