Webhooks

Webhooks let Contents Capture push events to your own systems: when something happens in your org, the platform sends an HTTP POST to a URL you control, signed so you can verify it really came from us.

Who this page is for

This page is for whoever manages your integrations, typically an IT contact or a developer at your company or a vendor. Managing webhooks requires the webhook.manage permission, held by org admins only. Find the page at System → Webhooks.

Endpoints

An endpoint is a URL that receives events. The Endpoints card lists every endpoint with its URL, subscriptions, and status.

Creating an endpoint

1. Click to create an endpoint.
2. Enter the Endpoint URL, the address of your receiving system.
3. Choose subscriptions: either Subscribe to all events (*) or check individual event types from the list. The full catalog is in Reference → Event types.
4. Save.

Copy the signing secret immediately

When an endpoint is created, its signing secret is shown once. Copy it and store it somewhere safe right away. After you close the dialog, the console only shows a hint like "…a3f9", and there is no way to retrieve the full secret. If you lose it, you must rotate to a new endpoint.

Managing endpoints

Per endpoint you can:

• Edit: change the URL or subscriptions.
• Activate / Archive: pause delivery without deleting the endpoint, then resume later.
• Delete: remove the endpoint entirely.

The payload and signature

Every delivery is a POST with a JSON body containing:

• event: the domain event, with its id, type, actor, organization, subject (kind and id), data payload, timestamp, and an idempotency key.
• deliveryId: a unique id for this delivery attempt.
• signedAt: when the delivery was signed.

The request carries an X-CC-Signature header containing an HMAC-SHA256 signature computed with your endpoint's signing secret. Verify this signature in your receiving code before trusting the payload; it proves the request came from Contents Capture and was not tampered with in transit.

Event types

There are 33 org-visible event types grouped by area: assignments, users, invitations, access, locations, groups, people, media, submissions, profiles, webhooks, and integrations. The complete table with plain-language descriptions is in Reference → Event types. The same events also drive workflows, so what you can automate in the console, you can also receive externally.

Recent deliveries

The Recent deliveries card shows what actually happened on the wire:

Column	Meaning
When	Delivery time.
Endpoint	Which endpoint was called.
Status	Delivered, failed, or pending.
Response code	The HTTP status your server returned, for example 200 or 500.
Attempts	How many delivery attempts were made.
Last error	The most recent failure detail.

Click a row to open the Delivery detail drawer, which shows the exact request headers and body and the exact response headers and body. When an integration misbehaves, this drawer is the first place to look: it tells you whether the problem is your server's response, a network issue, or the payload itself.

Incoming webhooks

The traffic is not only outbound. The Incoming webhooks card lets other systems POST payloads to Contents Capture at /webhooks/incoming/:source, where the source identifies the sending system. The card lists received payloads (when, source) with a View action opening a drawer containing the full payload JSON, so you can confirm exactly what external systems are sending in.

Good practices

• Respond fast. Your endpoint should return a 2xx response quickly and do heavy processing asynchronously. Slow responses look like failures and trigger retries.
• Always verify the signature. Check X-CC-Signature against your signing secret before acting on any payload.
• Use the idempotency key. Retries and replays can deliver the same event more than once. Store processed idempotency keys and skip duplicates so a retried delivery never creates duplicate records on your side.
• Watch the deliveries feed after changes. Any time you edit an endpoint URL or your receiving code deploys, check Recent deliveries for a spike in failures.