Webhooks
Overview

Webhooks

Cobuntu pushes events to URLs you configure. Use webhooks to sync data, trigger automations, send Slack notifications, post to HubSpot, or kick off any other side effect when something happens in your community.

What you can subscribe to

40+ events across member lifecycle, applications, articles, forms, events / RSVPs, orders, payouts, broadcasts. Full catalog at Event catalog.

Set up a webhook

In cobuntu-admin → Integrations → Webhooks:

  1. Click Create webhook.
  2. Paste your receiver URL (must be HTTPS, accept POST).
  3. Select the events you want.
  4. Copy the signing secret that's shown once — you'll use it to verify each delivery's HMAC signature (see Verify signatures).

Anatomy of a delivery

POST /your-receiver-url HTTP/1.1
Host: yourdomain.com
Content-Type: application/json
Cobuntu-Signature: t=1716700000,v1=2b3c4d5e...
Cobuntu-Delivery-Id: del_8f9a2b3c4d5e6f7g
Cobuntu-Event: member.approved
User-Agent: Cobuntu-Webhooks/1.0
 
{
  "event": "member.approved",
  "deliveryId": "del_8f9a2b3c4d5e6f7g",
  "createdAt": "2026-05-26T15:33:20Z",
  "communityTag": "my-community",
  "data": {
    "memberId": "mem_abc123",
    "userId": "usr_xyz789",
    "approvedAt": "2026-05-26T15:33:20Z",
    "approvedBy": "usr_def456"
  }
}
  • Cobuntu-Signature — HMAC-SHA256 over {timestamp}.{body}, signed with your webhook secret. How to verify →
  • Cobuntu-Delivery-Id — unique per delivery. Use it for idempotency: a webhook may be delivered more than once.
  • Cobuntu-Event — event name, also in the body.

Delivery guarantees

  • At-least-once delivery. Your receiver may see the same deliveryId more than once. Idempotency is your job.
  • Exponential backoff retries: 1m → 5m → 30m → 2h → 24h, max 5 attempts. After the final failure, the delivery is marked PERMANENTLY_FAILED — you can manually replay from the Recent deliveries tab in admin.
  • Success = HTTP 2xx within 10s. Anything else triggers a retry.
  • No ordering guarantee. A member.approved may arrive before the member.requested that preceded it. Use timestamps in the payload, not arrival order.

Test locally with the CLI

Coming soon — cobuntu webhooks listen --forward https://localhost:3000/webhook will tunnel events from prod to your laptop, Stripe-CLI style. Until then, use ngrok or similar.

Where to look when things break

  • Admin → Integrations → Recent deliveries. Every attempt logged: status code, response body, timing. Failed deliveries have a Resend button.
  • Cobuntu-Delivery-Id header. Search your logs by this id to correlate a Cobuntu attempt with your receiver's processing.
ErrorsEvent catalog