Operational
Run started, activity updated, run completed, finding created and proposal state changed.
Signed webhooks
Subscribe authorized endpoints to site, run, finding, proposal, quota and provider-health events. Payload examples are illustrative until verified against the current event schema.
POST /your-endpoint SEOForge-Event: proposal.ready SEOForge-Delivery: del_example
Event families
Run started, activity updated, run completed, finding created and proposal state changed.
Quota threshold, provider degraded, connection revoked and delivery disabled.
Signatures
expected = HMAC_SHA256(secret, timestamp + "." + raw_body) reject stale timestamps; compare signatures in constant time
Scopes
Creating or rotating an endpoint requires webhook management permission. Delivered objects remain limited to the configured workspace and authorized sites.
Retries
Use the delivery ID as the idempotency key. Return a 2xx response after durable receipt; transient failures retry on the published schedule. Repeated failures may disable delivery.
Errors
Inspect status, attempt count, response code and next attempt without recording secret values or sensitive payloads in application logs.
A webhook can report proposal state but can never approve, merge, deploy, retrieve credentials or bypass protection. Treat payload content as untrusted input.
Paid deployment · human authority
Choose a plan or talk to sales about event volume and retention.