# Webhooks

Point Luuphub at an HTTPS endpoint and it delivers a signed JSON payload
whenever something happens — new feedback, a status change, a merge, a changelog
publish. Use them to sync to Slack, Zapier, Linear, or your own systems.

## Events

- `post.created`
- `post.status_changed`
- `post.moved`
- `post.merged`
- `comment.created`
- `changelog.published`

## Subscribing

Create an endpoint in the dashboard under **Developers → Webhooks**, or over the
REST API with a key carrying the `webhooks:write` scope. Provisioning an outbound
hook is an exfiltration-capable capability, so it needs that explicit write scope —
a read-only key can never point a hook at an attacker URL.

## Verifying deliveries

Deliveries follow the [Standard Webhooks](https://www.standardwebhooks.com/) spec.
Each request carries `webhook-id`, `webhook-timestamp`, and `webhook-signature`
headers. **Verify the signature** with your endpoint's signing secret before
trusting the body, and use `webhook-id` as an idempotency key — retries reuse the
same id.

```http
POST /your/endpoint HTTP/1.1
webhook-id: msg_2abc...
webhook-timestamp: 1712345678
webhook-signature: v1,g0hM9S...
content-type: application/json

{ "type": "post.created", "data": { ... } }
```

## Delivery guarantees

- **Retries with backoff** — a failed delivery is retried on an exponential
  schedule before it is given up on.
- **Auto-disable** — an endpoint that fails repeatedly (each attempt exhausting its
  retry budget) is automatically disabled so a dead URL does not queue forever. A
  single success resets the counter.
- **Timeouts + bounded logging** — slow endpoints are cut off, and a bounded slice
  of your endpoint's response is captured in the delivery log so you can debug from
  the dashboard.

## Next

- [REST API](/developers/docs/api) — read + write the same data.
- [MCP server](/developers/docs/mcp) — let an AI agent act on events.