Create webhook

Create a new webhook subscription. The secret is only returned once.

Delivery

Every delivery is an HTTPS POST to your URL (port 443, public address, no redirects) with Content-Type: application/json and these headers:

• X-Webhook-Event: the event name, e.g. content.ready. The same name is also in the body as event, so it is covered by the signature; prefer the body value.
• X-Webhook-Id: unique per delivery; retries reuse it
• X-Webhook-Timestamp: unix seconds
• X-Webhook-Signature: v1=<hex HMAC-SHA256 of "<timestamp>.<raw body>" using the webhook secret>

Any non-2xx response is retried up to three more times. Ten consecutive failed events pause the subscription.

2026-10-15 — Citation Engine approval lifecycle v2

BREAKING for Citation Engine webhook consumers: Citation Engine payloads now carry schemaVersion: 2. Staff approval emits content.ready (stage: ready, readyAt). content.approved (stage: approved, approvedAt) means every assigned client approved this exact revision, or staff explicitly approved it under current account-wide delegation. It no longer means staff review alone. Unmanaged content generation events are unchanged.

Before rollout, subscribe to content.ready for review intake; retain content.approved for delivery automation. Do not publish a content.ready document automatically. Read approvals.mode, revision fingerprint/version, authenticated document links and nextAction. Assign client approvers in each account's existing Delivery → Client profile configuration, or explicitly grant staff delegation there. Empty approver lists require configuration and do not imply consent.

Already delivered revisions retain their receipts. Undelivered historical approvals require explicit client consent or a fresh staff approval after delegation; they are never silently backfilled as delegated. Legacy reviewed fixes can continue into the checked review flow without re-generating their accepted text. Event names retain their subscription and signature envelope; only Citation Engine payload/approval semantics are versioned. See the Citation approval rollout guide in the repository for the operator preflight and recovery procedure.