Webhooks

Point Luuphub at an HTTPS endpoint and it delivers a signed JSON payload whenever something happens — new feedback, a status change, a merge, a changelog publish. Use them to sync to Slack, Zapier, Linear, or your own systems.

Events

• post.created
• post.status_changed
• post.moved
• post.merged
• comment.created
• changelog.published

Subscribing

Create an endpoint in the dashboard under Developers → Webhooks, or over the REST API with a key carrying the webhooks:write scope. Provisioning an outbound hook is an exfiltration-capable capability, so it needs that explicit write scope — a read-only key can never point a hook at an attacker URL.

Verifying deliveries

Deliveries follow the Standard Webhooks spec. Each request carries webhook-id, webhook-timestamp, and webhook-signature headers. Verify the signature with your endpoint's signing secret before trusting the body, and use webhook-id as an idempotency key — retries reuse the same id.

POST /your/endpoint HTTP/1.1
webhook-id: msg_2abc...
webhook-timestamp: 1712345678
webhook-signature: v1,g0hM9S...
content-type: application/json

{ "type": "post.created", "data": { ... } }

Delivery guarantees

• Retries with backoff — a failed delivery is retried on an exponential schedule before it is given up on.
• Auto-disable — an endpoint that fails repeatedly (each attempt exhausting its retry budget) is automatically disabled so a dead URL does not queue forever. A single success resets the counter.
• Timeouts + bounded logging — slow endpoints are cut off, and a bounded slice of your endpoint's response is captured in the delivery log so you can debug from the dashboard.

Next

• REST API — read + write the same data.
• MCP server — let an AI agent act on events.