Certyn supports outgoing webhooks: event notifications that Certyn POSTs to your endpoint.

Signed-in user only

All endpoints on this page need a signed-in user's bearer token. An API key is refused.

List event types

GET/api/webhooks/event-typesBearer Token

List webhooks

GET/api/webhooksBearer Token

Query:

projectId (optional)
includeGlobal (optional, default true)
page, pageSize

Register webhook

POST/api/webhooksBearer Token

Body:

{
  "name": "Release channel",
  "url": "https://hooks.example.com/certyn",
  "events": ["*"],
  "projectId": "optional-project-id",
  "format": "generic",
  "isActive": true
}

name, url and events are required. events takes event types from the list above, a prefix such as ticket.*, or * for all.
format is generic (default) or slack. There is no Teams or Discord format: point the webhook at a small relay that reshapes the JSON.
A new webhook starts inactive (isActive: false) unless you send isActive: true. Certyn does not deliver events to an inactive webhook. Turn it on with PATCH /api/webhooks/{id}.
The response has the webhook and its secret. Store the secret: you need it to check signatures.

URL rules:

HTTPS only.
No credentials in the URL, no localhost, no .local names, and no private or local IP addresses.

Update webhook

PATCH/api/webhooks/{id}Bearer Token

Send only the fields you change: name, url, events, projectId, description, format, isActive.

Delete webhook

DELETE/api/webhooks/{id}Bearer Token

Rotate secret

POST/api/webhooks/{id}/secret/rotateBearer Token

Test webhook

POST/api/webhooks/{id}/testBearer Token

Deliveries

GET/api/webhooks/{id}/deliveriesBearer Token

GET/api/webhooks/{id}/deliveries/{deliveryId}Bearer Token

POST/api/webhooks/{id}/deliveries/{deliveryId}/retryBearer Token

Payload

A generic delivery is a JSON envelope:

{
  "id": "event-id",
  "deliveryId": "delivery-id",
  "type": "ticket.created",
  "timestamp": "2026-10-20T09:00:00Z",
  "projectId": "project-id",
  "tenantId": "tenant-id",
  "data": {}
}

data holds the event. A test delivery sends "data": { "ok": true }.

A slack delivery is a Slack message instead.

Delivery

A delivery succeeds on any 2xx response. Redirects are not followed.
On failure, Certyn tries up to 5 times: at once, then after 30 seconds, 2 minutes, 10 minutes and 1 hour.
Each attempt times out after 10 seconds.
A payload larger than 256 KB is not sent.

Signature verification

generic deliveries include these headers:

X-Certyn-Event: the event type
X-Certyn-Event-Id
X-Certyn-Webhook-Id
X-Certyn-Delivery-Id
X-Certyn-Attempt: the attempt number, from 1
X-Certyn-Timestamp (ISO-8601)
X-Certyn-Signature in the form sha256=<lowercase hex>

The signature is an HMAC-SHA256 over:

<timestamp>.<raw_json_body>

<timestamp> is the X-Certyn-Timestamp value. Use your webhook secret (webhook-level secret, or tenant signing secret if configured) as the HMAC key.

slack deliveries have none of these headers and are not signed.