Webhooks

Webhooks let you push IntuitivePM events to external services in real time. When something happens in your workspace — a task is created, a sprint starts, or a team member is added — IntuitivePM sends an HTTP POST request to your configured endpoint with the event data.

Webhook delivery pipeline with retry logic

How Webhooks Work

You register a webhook URL and select which events to subscribe to.
When a subscribed event occurs, IntuitivePM sends a signed JSON payload to your URL.
Your endpoint processes the payload and returns a 2xx status code to confirm receipt.
If delivery fails, the system retries with configurable retry logic.

Webhooks are company-scoped. Each webhook belongs to the company workspace of the user who created it, and events are filtered by company to prevent cross-tenant data leakage.

Supported Events

IntuitivePM supports 21 webhook events across 6 categories:

Task Events

Event	Description
`task.created`	A new task is created
`task.updated`	A task is updated (status, priority, assignee, etc.)
`task.deleted`	A task is deleted
`task.completed`	A task status changes to Done
`task.assigned`	A task is assigned to a user
`task.commented`	A comment is added to a task

Project Events

Event	Description
`project.created`	A new project is created
`project.updated`	A project is updated
`project.deleted`	A project is deleted
`project.archived`	A project is archived

Sprint Events

Event	Description
`sprint.created`	A new sprint is created
`sprint.started`	A sprint is started
`sprint.completed`	A sprint is completed
`sprint.cancelled`	A sprint is cancelled

Team Events

Event	Description
`team.created`	A new team is created
`team.updated`	A team is updated
`team.member_added`	A member is added to a team
`team.member_removed`	A member is removed from a team

Label Events

Event	Description
`label.created`	A new label is created
`label.updated`	A label is updated
`label.deleted`	A label is deleted

Epic Events

Event	Description
`epic.created`	A new epic is created
`epic.updated`	An epic is updated
`epic.deleted`	An epic is deleted

Payload Format

Every webhook delivery sends a JSON payload with this structure:

{
  "event": "task.created",
  "timestamp": "2026-02-24T10:30:00.000Z",
  "data": {
    "taskId": "a1b2c3d4-...",
    "title": "Fix login redirect bug",
    "status": "To Do",
    "priority": "high",
    "projectId": "e5f6g7h8-...",
    "assigneeId": "i9j0k1l2-...",
    "createdById": "m3n4o5p6-...",
    "companyId": "q7r8s9t0-..."
  }
}

The data object varies by event type. Task events include task fields, project events include project fields, and so on.

Security: Webhook Signatures

Always verify webhook signatures

Without signature verification, any external party could send fake payloads to your endpoint. Always validate the X-Webhook-Signature header before processing webhook data in production.

Every webhook delivery includes a cryptographic signature so you can verify the payload came from IntuitivePM and was not tampered with. The signature is sent in HTTP headers:

Header	Description
`X-Webhook-Signature`	HMAC-SHA256 signature: `sha256=<hex>`
`X-Webhook-Event`	The event type (e.g., `task.created`)
`X-Webhook-Delivery`	Unique delivery ID (UUID)
`X-Webhook-Timestamp`	ISO 8601 timestamp of the event

Verifying Signatures

To verify a webhook delivery, compute the HMAC-SHA256 of the raw request body using your webhook secret and compare it to the X-Webhook-Signature header:

const crypto = require('crypto');

function verifyWebhookSignature(body, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(body)
    .digest('hex');
  return signature === `sha256=${expected}`;
}

When you create a webhook, IntuitivePM generates a secret key prefixed with whsec_. Store this secret securely — it is only shown once at creation time. You can regenerate the secret later if needed.

Creating a Webhook

Open webhook settings

Navigate to Settings > Integrations > Webhooks and click Create Webhook.

Configure the webhook

Enter a name (e.g., “CI/CD Pipeline Trigger”) and the endpoint URL. In production, the URL must use HTTPS.

Select events

Choose one or more events to subscribe to from the event list.

Create and save the secret

Click Create. Copy the generated secret (whsec_...) and store it securely — it is only shown once.

Configuration Options

Field	Default	Description
Name	Required	A descriptive name for the webhook
URL	Required	The endpoint URL (HTTPS required in production)
Events	Required	One or more events to subscribe to
Max Retries	3	Number of retry attempts on failure
Retry Delay	1000ms	Delay between retries in milliseconds
Custom Headers	None	Additional HTTP headers to include in deliveries

URL Validation and Security

IntuitivePM validates webhook URLs to prevent SSRF (Server-Side Request Forgery) attacks. The following URLs are blocked:

Localhost and loopback addresses (127.0.0.1, ::1)
Private network ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x)
Cloud metadata endpoints (169.254.169.254)
Internal Kubernetes service names (.svc.cluster.local)

In production, only HTTPS URLs are accepted.

Delivery and Retries

Reliable delivery with Kafka

When Kafka is available, webhook deliveries are queued for processing by a dedicated webhook worker. This ensures deliveries survive server restarts and are retried automatically on failure. If Kafka is unavailable, IntuitivePM falls back to direct delivery (fire-and-forget, no retries).

Each delivery attempt is logged with:

HTTP status code returned by your endpoint
Response body (truncated to 10,000 characters)
Duration in milliseconds
Success or failure status
Error message (if failed)

Timeout

Webhook deliveries have a 30-second timeout. If your endpoint does not respond within 30 seconds, the delivery is marked as failed.

Monitoring Deliveries

Navigate to Settings > Integrations > Webhooks, click on a webhook, and open the Delivery Logs tab. Each entry shows:

Event type and timestamp
HTTP status code
Success or failure
Response time
Error message (if any)

Delivery logs are retained for 30 days by default.

Testing a Webhook

Click the Test button next to any webhook to send a test delivery. The test payload uses the task.created event with sample data:

{
  "test": true,
  "message": "This is a test webhook delivery from IntuitivePM",
  "webhookId": "...",
  "webhookName": "My Webhook"
}

Check your endpoint and the delivery log to confirm receipt.

Managing Webhooks

Toggle active/inactive — Pause a webhook without deleting it. Inactive webhooks do not receive events.
Edit — Update the name, URL, events, retry settings, or custom headers.
Regenerate secret — Generate a new signing secret. Update your endpoint to use the new secret.
Delete — Permanently remove a webhook and its delivery history.

Next Steps

Set up Slack notifications with the Slack Integration guide.
Configure Teams webhooks in the Teams Integration guide.
See the Error Reference for webhook-related error codes.