Webhooks

Signed messages to your own code, or plain sentences in Slack, Discord or Teams.

In Settings, Messages to other tools, add an address (it must start with https:// and point to the public internet), choose the events and the kind of address, and copy the signing secret, which is shown once. Use Send a test to check it.

Events

• request.created: a suggestion was accepted and started a request.
• request.status_changed: a request moved to another status.
• suggestions.ready: reading a new source found suggestions.
• release_note.published: a note was published now (a note scheduled for later sends nothing).
• survey.response_completed: someone finished a survey.

Messages carry ids, statuses and titles of your own requests. They never carry customer quotes, names or email addresses.

The message

{ "id": "…event id…", "type": "request.status_changed",
  "createdAt": "2026-10-24T17:00:00Z", "workspaceId": "…", "data": { … } }

Headers: Webhook-Id (the same on every retry; use it to drop duplicates), Webhook-Event, and Webhook-Signature.

Checking the signature

Webhook-Signature is t=<unix seconds>,v1=<hex>, where v1 is the HMAC-SHA256 of "<t>.<raw body>" under your secret. Recompute it on the raw body, compare in constant time, and reject messages whose t is more than a few minutes from your clock.

Delivery

• Answer with any 2xx within 10 seconds. Redirects are not followed.
• Anything else is retried after 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours, 12 hours and 24 hours; after 8 attempts the message is marked failed.
• 30 failures in a row switch the address off; you switch it back on.
• History is kept 30 days. Delivery is at least once, so treat Webhook-Id as the key.
• Addresses that point inside a private network are refused when saved and again when sending.

Chat channels

Choose Slack, Discord or Microsoft Teams as the kind of address and paste the incoming-webhook address that tool gives you. Each event arrives as one plain sentence with a link. Customer-derived titles are made safe: no mentions, no smuggled links or markup.