Outgoing webhooks
Getting told when something happens in your workspace, and verifying it came from us.
An outgoing webhook is a URL of yours that Noots POSTs to when something happens. Set them up at Org settings → API & Webhooks; creating one needs permission to edit the organization, and webhooks are on the Business plan and above.
- 1Enter your endpoint. It must be
https://. - 2Tick the events you want. Ticking none subscribes you to all of them.
- 3Save. A signing secret is generated for you at that moment.
The five events
| Event | Sent when | data carries |
|---|---|---|
task.created | A task is added to a board — by a person, an import, a meeting or a rule. | id, nootId, title, status, createdBy |
noot.created | A project is created in this workspace. | id, name |
meeting.completed | A recorded meeting has finished processing and its notes are ready. | id, title, nootId, summary |
member.joined | Someone becomes an active member of this workspace. | userId, name, email, role |
automation.fired | One of your automations ran and its "send to your webhooks" action fired. | The rule and project, plus the task where there is one, and the inbound payload on a hook-triggered rule. |
It fires for a genuinely new, active membership — an accepted invitation, an admin adding somebody, or an approved join request at the moment it is approved. It does not fire for a join request while it is still pending, nor when your identity provider re-syncs somebody who is already a member. You will not get a burst of them every time SCIM runs.
The request we send
A POST with this body:
{ "event": "task.created", "data": { … }, "sentAt": "2026-07-30T09:14:22.104Z" }
| Header | Value |
|---|---|
Content-Type | application/json |
User-Agent | Noots-Webhooks/1 |
X-Noots-Event | The event name, so you can route without parsing the body. |
X-Noots-Signature | sha256= followed by a hex HMAC — see below. |
Verifying the signature
X-Noots-Signature is sha256= plus the HMAC-SHA256 of the exact raw request body, keyed with your endpoint's secret. Compute it over the bytes you received, not over an object you parsed and re-serialised — JSON round-trips are not byte-stable, and that is the single most common reason a verification fails against a request that was perfectly valid. Compare in constant time.
How we deliver
- Attempts
- One. There is no retry queue, no backoff and no dead-letter. A delivery your endpoint missed is not repeated.
- Timeout
- 4 seconds. Answer quickly and do the work afterwards.
- Your response
- Not examined. Any status is treated the same, so you cannot signal a retry by failing.
- Redirects
- Not followed. Point us at the final URL.
- Where we'll connect
- Public addresses only. A URL that resolves to a private, loopback or link-local address is refused, and the address is pinned once resolved so it cannot be swapped underneath us.
- Delivery log
- There isn't one. Noots does not record what it sent you or how your endpoint answered — log it on your side.
One attempt with no retries means a webhook is a notification, not a transport you can rely on for state. If your integration must not miss anything, treat each event as a hint and reconcile against the v1 API — don't accumulate state from the stream alone.