Webhooks

Configuring webhooks

Go to Workspace settings → Webhooks → Add endpoint. Enter your URL and select which events you want to receive.

Event types

• automation.run — an automation finished running (success or failure).
• automation.failed — an automation failed and couldn't recover.
• integration.connected — a new integration was connected.
• integration.disconnected — an integration was disconnected (manually or due to auth failure).
• member.invited — a new member was invited to the workspace.
• member.joined — an invited member accepted.

Payload format

{
  "id": "evt_abc123",
  "type": "automation.run",
  "created_at": "2026-08-01T10:30:00Z",
  "data": {
    "automation_id": "aut_xyz",
    "automation_name": "PR merged notification",
    "status": "success",
    "duration_ms": 1240
  }
}

Verifying signatures

Every webhook is signed with your endpoint's signing secret. Verify the X-Ion-Signature header:

import crypto from "crypto";

function verifySignature(payload: string, signature: string, secret: string) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(payload)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature)
  );
}

Retries

If your endpoint returns a non-2xx response, we retry with exponential backoff: 1min, 5min, 30min, 2hr, 6hr. After 5 failed attempts, the webhook is disabled and you'll get an email.