Webhooks

Subscribe to events (e.g. issue.reply.created) so your backend hears about changes without polling.

mutation Endpoint($input: CreateWebhookEndpointInput!) {
  createWebhookEndpoint(input: $input) {
    endpoint { id url events isActive }
    secret   # signing secret — shown once
    error { code message }
  }
}

{ "input": { "url": "https://api.example.com/clad/webhooks", "events": ["*"] } }

Deliveries are signed. Each request includes:

• Clad-Event-Id — unique per event; use it as your idempotency key.
• Clad-Event-Type
• Clad-Webhook-Timestamp
• Clad-Webhook-Signature: v1=<hex> — HMAC-SHA256 over timestamp.event_id.raw_body using your signing secret.

Verify the signature before trusting a delivery. Respond 2xx to acknowledge; non-2xx responses are retried. Use pingWebhookEndpoint to send a test webhook.ping, webhookDeliveries to inspect recent attempts, and webhookEventTypes to list every event you can subscribe to. Rotate a secret with rotateWebhookSecret (the old one stops working immediately). Managing webhooks requires the webhooks:manage scope.