Webhooks

Goal created

Workpath POSTs the signed envelope below to the endpoint URL of every subscription to this event type when a Goal is created. Verify X-Workpath-Signature over the raw body, then respond with any 2xx to acknowledge. Secret Goals are never delivered.

postWebhookgoal.created

Headers

X-Workpath-Eventstring required
Example:goal.created

The event key (matches event in the body).

X-Workpath-Signaturestring required

Base64-encoded raw Ed25519 signature of the exact request body.

X-Workpath-Key-IDstring required
Example:production

Identifies which published public key signed this delivery.

Payload

schema_versioninteger required

Envelope schema version. Increments only on breaking changes (field removal, rename, type change). Additive new fields do not bump it — consumers must ignore unknown fields.

account_subdomainstring required

Subdomain of the Workpath account the event belongs to (e.g. acme for acme.workpath.com). Useful if your organization has multiple Workpath subdomains.

eventstring required

The event key, e.g. goal.created. Matches the X-Workpath-Event header.

event_idinteger required

Monotonic, 1-based sequence number scoped to your subscription. Use it as an idempotency key — retried deliveries reuse the same value.

created_atstring date-time required

When the event occurred in Workpath (not when it was delivered).

Example payload

{
  "schema_version": 1,
  "account_subdomain": "acme",
  "event": "goal.created",
  "event_id": 9,
  "created_at": "2026-04-30T09:17:32Z",
  "data": {
    "id": 42,
    "title": "Increase EU revenue by 15%",
    "description": "Drive growth across DACH and Nordics with focused account expansion.",
    "progress": 0.45,
    "confidence_level": 8,
    "start_date": "2026-01-01",
    "target_date": "2026-06-30",
    "created_at": "2026-01-08T14:22:00Z",
    "updated_at": "2026-04-30T09:17:30Z"
  }
}

Response

Any 2xx acknowledges receipt. A non-2xx response or timeout is retried.

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.