Explore SEOForge

Signed webhooks

Receive operational state changes without polling the queue.

Subscribe authorized endpoints to site, run, finding, proposal, quota and provider-health events. Payload examples are illustrative until verified against the current event schema.

Nothing publishes without approvalPaid product accessNo ranking guarantees
POST /your-endpoint
SEOForge-Event: proposal.ready
SEOForge-Delivery: del_example

Event families

Subscribe to the smallest relevant set.

Operational

Run started, activity updated, run completed, finding created and proposal state changed.

Control health

Quota threshold, provider degraded, connection revoked and delivery disabled.

Signatures

Verify the raw body before parsing.

expected = HMAC_SHA256(secret, timestamp + "." + raw_body)
reject stale timestamps; compare signatures in constant time

Scopes

Endpoints are workspace- and event-scoped.

Creating or rotating an endpoint requires webhook management permission. Delivered objects remain limited to the configured workspace and authorized sites.

Retries

Acknowledge quickly and process idempotently.

Use the delivery ID as the idempotency key. Return a 2xx response after durable receipt; transient failures retry on the published schedule. Repeated failures may disable delivery.

Errors

Use delivery history for safe recovery.

Inspect status, attempt count, response code and next attempt without recording secret values or sensitive payloads in application logs.

Notification is not authority

A webhook can report proposal state but can never approve, merge, deploy, retrieve credentials or bypass protection. Treat payload content as untrusted input.

Paid deployment · human authority

Configure signed delivery inside a paid workspace.

Choose a plan or talk to sales about event volume and retention.