# Webhooks

> Subscribe to events, verify signed deliveries, and manage endpoints.

Product: Clad API
Source: https://docs.useclad.ai/api/webhooks

---

Subscribe to events (e.g. `issue.reply.created`) so your backend hears about
changes without polling.

```graphql
mutation Endpoint($input: CreateWebhookEndpointInput!) {
  createWebhookEndpoint(input: $input) {
    endpoint { id url events isActive }
    secret   # signing secret — shown once
    error { code message }
  }
}
```

```json
{ "input": { "url": "https://api.example.com/clad/webhooks", "events": ["*"] } }
```

Deliveries are signed. Each request includes:

- `Clad-Event-Id` — unique per event; use it as your idempotency key.
- `Clad-Event-Type`
- `Clad-Webhook-Timestamp`
- `Clad-Webhook-Signature: v1=<hex>` — HMAC-SHA256 over
  `timestamp.event_id.raw_body` using your signing secret.

Verify the signature before trusting a delivery. Respond `2xx` to acknowledge;
non-2xx responses are retried. Use `pingWebhookEndpoint` to send a test
`webhook.ping`, `webhookDeliveries` to inspect recent attempts, and
`webhookEventTypes` to list every event you can subscribe to. Rotate a secret
with `rotateWebhookSecret` (the old one stops working immediately). Managing
webhooks requires the `webhooks:manage` scope.