Webhooks

Register a webhook against an organization and subscribe it to one or more event types. Deliveries are signed with HMAC; verify the signature before trusting the body.

Event types

• message.created — A message is posted
• message.updated — A message is edited
• message.deleted — A message is deleted
• reaction.added — Somebody reacts to a message
• channel.created — A channel is created
• space.created — A space is created
• member.joined — Somebody joins
• member.left — Somebody leaves or is removed
• channel.went_quiet — A channel has had no messages for a while

Payloads are deliberately narrow — identifiers, plus the few fields a consumer cannot look up without another round trip. A webhook body is a public contract with every customer who ever subscribed, and widening one later is easy while narrowing one is a breaking change.

A destination that keeps failing is disabled automatically. Read its recent attempts at GET /api/webhooks/:webhook/deliveries, fix the endpoint, and resume it with PATCH /api/webhooks/:webhook and isActive: true — the failure count is measured from the moment you resume, so a fixed destination is not disabled again by the failures that preceded the fix. The id and the signing secret are kept.