Look up webhook events and payloads

This page lists the events a webhookWebhook An address you give the hub so it can send your own systems a message whenever a feed post or comment changes. sends, how each message arrives, and what it holds once decrypted.

Events

• Every case in your hub sends them, whoever made the change: staff, a client, the Virtual AssistantVirtual Assistant An automated team member that posts welcome messages, check-ins and stage updates for the firm; its posts carry a Virtual Assistant badge., an import or an API key. A post's or comment's events still come after its author has left the case.
• Deleting a case sends nothing, not even delete_post for the posts its deletion removes. Once it's deleted, the API answers 404 for the case.
• Only posts and comments on posts send events. Notes, tasks, forms, e-signs, events and their comments send nothing, and so does a change to who can see a post.
• A post with files sends add_post, then one add_post_media for each file.
• A file link works for 48 hours. A removed file is deleted soon after, so the link in a delete event may not open.
• A mention in the text reads <@, the person's user ID and >, such as <@cu-4f1c2a9e8b7d60>.

Delivery

• Each message is a POST to the webhook's address, with a JSON body holding one field, payload: the encrypted message.
• Any status below 400 within 10 seconds counts as delivered.
• A delivery that fails isn't sent again. Two in a row stop the webhook; see Fix a webhook that stopped sending.
• A message can arrive twice, or out of order. Use the event, the item's ID and when to tell.

{"payload": "eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkExMjhDQkMtSFMyNTYifQ.…"}

Decrypting

payload is a JWE in compact form, encrypted with RSA-OAEP and A128CBC-HS256. The webhook's secret is the matching private key, a PEM file that starts -----BEGIN PRIVATE KEY-----. Use the downloaded file, or the secret copied whole with its line breaks. Any JOSE library can decrypt it.

Python, with jwcrypto:

import json
from jwcrypto import jwk, jwt

with open("webhook-private-key.pem", "rb") as f:
    key = jwk.JWK.from_pem(f.read())

def read_message(body):
    token = jwt.JWT(jwt=body["payload"], key=key, expected_type="JWE")
    return json.loads(token.claims)

Node.js, with jose:

import { readFileSync } from 'node:fs';
import { compactDecrypt, importPKCS8 } from 'jose';

const key = await importPKCS8(readFileSync('webhook-private-key.pem', 'utf8'), 'RSA-OAEP');

export async function readMessage(body) {
  const { plaintext } = await compactDecrypt(body.payload, key);
  return JSON.parse(new TextDecoder().decode(plaintext));
}

There's no separate signature. Your hub never shows the key it encrypts with, so a message that decrypts with your secret came from your hub, and one changed on the way fails to decrypt. If several hubs send to the same address, check who.host.host_id as well.

The message

A decrypted add_post:

{
  "who": {
    "user_id": "cu-4f1c2a9e8b7d60",
    "cc_owner": false,
    "post": {"post_id": "post::20261001140322_9f8e7d6c5b4a32"},
    "case": {"case_id": "cc-1a2b3c4d5e6f70", "case_ref_id": "rear-end-2026"},
    "role": {"role_id": "role::staff"},
    "host": {"host_id": "ca-7e6d5c4b3a2f10"}
  },
  "what": {
    "trigger": {"name": "add_post"},
    "content": {
      "new": "Hi Jane, your records request went out today.",
      "type": "app_add_post",
      "kwargs": {"case_id": "cc-1a2b3c4d5e6f70", "case_ref_id": "rear-end-2026"}
    }
  },
  "where": {"location": {"name": "app"}, "module": {"name": "post"}},
  "when": {"datetime": {"timezone": "utc", "datetime": "2026-10-01T14:03:22.123456+0000"}},
  "targets": {"user_ids": ["cu-4f1c2a9e8b7d60"], "cc_user_ids": [], "group_targets": false}
}

The other fields are for the hub's own use; ignore them.