Developer integration
Every mutation, signed and delivered.
Register an endpoint and Weekwright POSTs it when things change in your organization. The delivery hooks the one place in the codebase that sees every mutation, so an event cannot be added without the webhook knowing about it.
- Category
- Developer
- Setup
- 15 minutes, once
- Who sets it up
- An owner
- Plans
- Every plan, including the free tier.
What you get
Outbound webhooks + Weekwright.
- HMAC-SHA256 signatures with the timestamp inside the signed material, sent as X-Weekwright-Signature: t=<unix>,v1=<hex> — the same construction Stripe uses, so a replay cannot be re-signed.
- Exponential-backoff retries drained by a per-minute job, with an endpoint auto-disabled after 10 consecutive failures so your outage does not become our queue.
- Events default to SILENCE. An action is only delivered once you opt into it — no surprise firehose when we ship a new tool.
- A SSRF gate on registration: private IP ranges, cloud metadata addresses, IPv4-mapped IPv6, lookalike hosts, and embedded credentials are all refused.
Setup
How it works.
- 1
Register your HTTPS endpoint and pick the event types you want. Owner-only.
- 2
Store the signing secret Weekwright returns. Verify every request: recompute the HMAC over the timestamp and body, compare in constant time, and reject anything older than your tolerance window.
- 3
Return a 2xx quickly and do your work asynchronously. Slow handlers get retried, which means duplicates.
- 4
Treat deliveries as at-least-once and key your handler on the event id so a retry is a no-op.
Honest limits
What this does not do.
Every integration has edges. Better you read them here than discover them the week you go live.
- At-least-once delivery, not exactly-once. Retries mean your handler must be idempotent — that is your side of the contract.
- No ordering guarantee across events. Two edits landing out of order is normal; use the payload's own timestamps rather than arrival order.
- There is no public developer API behind this. Webhooks tell you something changed; reading and writing data still goes through the app or a scoped integration key with an explicit tool allowlist.
- HTTPS endpoints on public addresses only. A localhost or private-range URL is refused at registration, so develop against a tunnel.
Common questions
Outbound webhooks FAQ.
How do I verify a Weekwright webhook signature?
Read the X-Weekwright-Signature header, which contains t=<unix seconds> and v1=<hex hmac>. Recompute HMAC-SHA256 over the timestamp and the raw request body using your signing secret, compare against v1 in constant time, and reject requests whose timestamp is outside your tolerance window. Because the timestamp is inside the signed material, a captured request cannot be replayed with a fresh one.
What happens if my endpoint is down?
Deliveries are retried with exponential backoff. After 10 consecutive failures the endpoint is automatically disabled and you can re-enable it once you have fixed the receiver — a permanently broken endpoint should not accumulate a queue forever.
Is there a REST API too?
There is no public developer API and that is a deliberate decision, not a roadmap gap. Where a machine credential is genuinely needed, a scoped integration key is bound to one organization with an explicit default-deny tool allowlist and a role ceiling, and it acts as its creator — so demoting or offboarding that person kills the key automatically.
One tool for the schedule, wired into the rest of your stack.
Free for a single location, no credit card. Every plan, including the free tier.