Webhook management lives under Settings → Webhooks. Only workspace members can manage webhooks — there’s no public API for CRUD by design. This keeps the audit trail tied to a real human and avoids “rogue webhook” scenarios where a leaked API key could redirect events.
Permissions
| Permission | Owner | Admin | Viewer |
|---|
webhooks:read | ✅ | ✅ | ✅ |
webhooks:create | ✅ | ✅ | — |
webhooks:update | ✅ | ✅ | — |
webhooks:delete | ✅ | ✅ | — |
webhooks:rotate | ✅ | ✅ | — |
webhooks:secret_read | ✅ | ✅ | — |
Creating an endpoint
- Settings → Webhooks → Create webhook
- Fill in: name, endpoint URL (must be http/https), optional description, and at least one event type.
- On save, the signing secret is shown once in a modal — copy it now. It’s never displayed again.
- The endpoint is enabled by default and starts receiving deliveries immediately.
The secret is only shown the moment you create the endpoint and again immediately after rotation. If you lose it, you must rotate to get a new one.
Editing
Edit the endpoint’s name, URL, description, subscribed events, or enable/disable it. Changes take effect on the next event — deliveries already in flight finish with the old configuration.
Rotating the signing secret
From the actions dropdown on a webhook row:
- Click Rotate secret
- A modal shows the new secret — copy it
- The old secret stops working immediately
- Update your receiver and restart
Disabling vs deleting
- Disabling keeps the endpoint configured but stops fanning out new deliveries. Re-enable any time without losing history.
- Deleting is soft — the endpoint row is marked deleted; existing deliveries can no longer fire. There’s no undo.
Viewing deliveries
Click the dropdown on any webhook row → View deliveries. A drawer opens showing the most recent delivery attempts with:
- Event type and status badge (succeeded / failed / pending)
- HTTP response code
- Attempt number and timestamp
- Error message (if any)
- Resend button to re-queue a failed delivery
Limits
| Limit | Value |
|---|
| Max endpoints per workspace | 20 |
| Webhook name length | 1–64 characters |
| URL length | up to 2048 characters |
| Description length | up to 200 characters |
| Request timeout | 10 seconds |
| Max delivery attempts | 5 |
