Webhooks

Webhooks that don't drop events

HMAC-SHA256 signed payloads, exponential-backoff retries, replay-from-anywhere and a test-fire button on every endpoint.

Configure webhooks Read the spec

8 event types

Subscribe to what matters

Every endpoint can opt into one or many events. Payload schemas are versioned and documented in OpenAPI.

site.created

New site provisioned

site.provisioned

Provisioning finished

site.suspended

Site auto-suspended

site.cancelled

Customer cancelled

plugin.installed

Plugin attached to a site

plugin.uninstalled

Plugin detached

invoice.issued

New invoice generated

invoice.paid

Invoice settled

Signed payloads

Every request includes an X-RadCMS-Signature header you can verify against your endpoint's signing secret. Reject any request that fails verification — that is how you prevent forgery.

HMAC-SHA256 over the raw request body.
Signing secret revealed once on creation, never again.
Rotation supported — old + new keys both validate for 7 days.
Replay protection via X-RadCMS-Timestamp + a 5-minute window.

// PHP — verify a radcms webhook
$secret    = env('RADCMS_WEBHOOK_SECRET');
$payload   = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_RADCMS_SIGNATURE'];

$expected = 'sha256=' .
  hash_hmac('sha256', $payload, $secret);

if (! hash_equals($expected, $signature)) {
  http_response_code(401);
  exit('Invalid signature');
}

$event = json_decode($payload, true);
// process $event …

Built to survive your downtime

Your endpoint having a bad day shouldn't lose events. Here's how we handle it.

Exponential backoff

Retries at 1s, 10s, 1m, 10m, 1h, 1d. After 6 failed attempts the endpoint is auto-suspended pending operator action.

Replay from anywhere

Every delivery is recorded with full payload + response. Replay individual events or a date range with one click from the dashboard.

Per-endpoint test

Hit a Test button in the dashboard to fire a sample payload to your endpoint. See the response code, body and timing inline.

Live delivery log

Last 7 days of deliveries per endpoint, with HTTP code, latency and the exact request/response shown.

Auto-disable after N failures

6 consecutive failures pauses the endpoint and emails your team. Re-enable from the dashboard once you have fixed it.

IP allowlist (Enterprise)

All radcms outbound webhook traffic originates from a documented set of IPs. Enterprise customers can pin a stricter allowlist.

Ready to wire up your stack?

Create an account and add your first endpoint in under a minute.

Get started — it's free