Create webhook subscription

POST 
/webhooks

The hmacSecret in the response is only returned on creation. Store it immediately — it cannot be retrieved again.

Partner integration guide

For worked payload examples, recommended subscriptions, and partner action notes for every event, see the Webhooks partner guide.

Recommended subscriptions for integration partners:

Event	Why
time.submitted	Trigger your approval workflow or notify a manager in your system
time.approved	Mark the time log as locked/billable in your system
time.rejected	Notify the logger to correct and resubmit
time.unlocked	Reopen the time log for editing in your system
time.updated	Sync field changes (hours, date, description) to your local record
user.invited	Upsert the user into your local member directory
user.updated	Sync name or role changes to your local record
release.released	Trigger downstream release automation or customer notifications
agreement.signed	Archive the signed agreement and update your compliance records

Event payload envelope — every delivery contains:

{
  "id": "delivery-uuid",
  "eventName": "time.approved",
  "schemaVersion": 1,
  "entityType": "time_entry",
  "entityId": "te-uuid-...",
  "occurredAt": "2026-05-26T12:00:00Z",
  "actorUserId": "manager-uuid-...",
  "payload": { /* event-specific fields */ }
}

For full payload schemas and per-event worked examples, see the Webhooks partner guide.

Request

Header Parameters

Idempotency-Key string

Optional idempotency key (24 h cache). Repeat calls with the same key and path return the cached response.

Body

required

destinationUrlurirequired
Example: https://hooks.example.com/align
eventNamesstring[]required
Possible values: [entry.created, entry.updated, entry.status_changed, entry.assigned, entry.commented, release.created, release.status_changed, release.released, cost.estimate_requested, cost.estimation.run.started, cost.estimation.run.finished, cost.estimation.run.failed, invoice.paid, invoice.payment_failed, invoice.finalized, cost.approved, cost.rejected, agreement.signed, pr.merged, pr.reopened, github.identity.connected, github.identity.disconnected, github.identity.policy.violated, commit.linked, commit.unlinked, ci.run.attributed, commit.entry.suggestion.generated, commit.risk.generated, release.notes.generated, project.status.update.generated, pr.description.generated, commit.suggestion.surfaced, commit.suggestion.accepted, commit.suggestion.rejected, ci.flaky.override.set, ci.gate.evaluated, agreement.persissio.callback.received, tenant.created, tenant.verified, tenant.suspended, subscription.created, subscription.updated, usage.limit.hit, subscription.upgraded, subscription.downgraded, subscription.cancelled, trial.ending_soon, trial.ended, dunning.email.sent, analytics.tenant.opted_out, analytics.tenant.opted_in, status.incident.created, status.incident.updated, status.incident.resolved, status.component.overridden, changelog.entry.scheduled, changelog.entry.published, api_key.created, api_key.revoked, api_key.used, api.rate_limit.hit, webhook.subscription.created, webhook.subscription.deleted, time.logged, time.submitted, time.approved, time.rejected, time.unlocked, report.viewed, report.exported, reviewer.suggestion.generated, commit.linter.advisory.posted], >= 1
Example: ["entry.created","entry.updated"]
descriptionstring | nullnullable
Example: Notify CI pipeline.

Created

Schema

iduuidrequired
destinationUrlurirequired
eventNamesstring[]required
enabledbooleanrequired
descriptionstring | nullnullablerequired
hmacSecretstringrequired
HMAC signing secret. Only returned on creation — store it immediately.
Example: whsec_abc123...
createdAtdate-timerequired