Webhooks

Add a webhook

In Project → Developers, add the https address of your server and choose the events. Copy the signing secret: it is shown once. “Send test event” sends a ping so you can check your server. Only project admins can change webhooks.

Events

• task.created: feedback was left on the website, or a task was made in the dashboard.
• task.updated: title, status, priority, assignee, due date, labels or linked commits changed (with what changed).
• task.status_changed: from one status to another.
• task.deleted, task.restored (brought back within 30 days) and comment.created.

Every request is a JSON POST with id, type, api_version, created_at, project and data. The full payloads are in the API reference under Webhooks.

Check the signature

The CommentKit-Signature header is t=timestamp,v1=signature: an HMAC-SHA256 of the timestamp, a dot and the raw body, made with your signing secret. Compare it in constant time and refuse requests older than five minutes. For a day after you replace the secret, a second v1= made with the old secret follows, so accept the request when either matches. The Developers page has a copyable example.

Retries and replay

Answer with any 2xx status within 10 seconds. If your server does not, CommentKit tries again after 1 minute, 5 minutes, 30 minutes, 2, 6 and 12 hours. After five events in a row could not be delivered, the webhook is turned off and the workspace owner gets an email. The delivery log shows each attempt and what your server answered; “Send again” replays an event with the same CommentKit-Event-Id, so you can ignore repeats.