Webhooks

A webhook sends a signed POST to your URL when something happens to a post in a workspace.

Events

Event	When
post.scheduled	A post was scheduled
post.published	A post went out on a network
post.failed	A network refused the post
post.deleted	A post was deleted

GET /webhooks/event-types returns the current list.

Add one

In the app (workspace → Webhooks), with the API, or with the CLI:

sp webhooks add https://example.com/hook --events post.published
sp webhooks test <id>

Failed deliveries are retried, and every attempt is in the delivery log (GET /workspaces/{id}/webhooks/{endpointId}/deliveries).

Verify the signature

Each call carries two headers:

X-Webhook-Timestamp: 1767225600
X-Webhook-Signature: v1=<hex HMAC-SHA256(secret, "<timestamp>.<raw body>")>

import crypto from 'node:crypto';

function isValid(rawBody, timestamp, signature, secret) {
  const expected = 'v1=' + crypto.createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

Use the raw request body, before any JSON parsing. Reject old timestamps to stop replays.

Webhooks are included from the Team plan up — see Limits and plans.