Webhooks

Every event, with its payload and a sample delivery, is listed in the event reference: open any group folder below (Members, Spaces, Events, …).

Overview

Webhooks send an HTTPS POST to your server when something happens in your community.

You add an endpoint, choose which events you want, and Networked sends each matching event to your URL as JSON. This guide describes version 2026-10-21.

What you can build

Sync new members to your CRM. Subscribe to user.joined. When a membership becomes active, create or update the contact in your CRM.

Send event registrations to a spreadsheet. Subscribe to event.registered. Add one row for each registration.

Alert your team about paid members. Subscribe to the payments group. Post a message to your team chat when money comes in.

Event groups

There are 98 events in 12 groups. You can subscribe to single events or to whole groups.

Code	Group	What it covers
100	Members	Joining, leaving, roles, invites, profiles and verification.
200	Spaces	Space lifecycle and space membership.
300	Events	Community events, registrations and attendance.
400	Feed	Posts, comments, polls and surveys across every post type.
500	Live video	Live video rooms (event rooms and ad-hoc sessions).
600	Courses	Courses, enrolment and learner progress.
700	Newsletter	Subscribers, sends and per-recipient email activity.
800	Payments	Subscriptions, purchases, refunds and offers (money the community earns).
900	Opportunities	Jobs, services and fundraising listings.
1000	Media	Media library items of every type.
1100	Community	Community settings, token usage, website, app and integrations.
1200	Chat	Public channel chat only.

See the event reference for every event name and its data payload.

Set up a webhook endpoint

You create webhook endpoints in your community's admin area, on the API page.

Steps

Open the admin area and go to the API page. Open the Webhooks section.

Add an endpoint. Enter a name and a URL, for example https://example.com/webhooks/networked.

Verify the URL with the verify step on the form.

Choose which events to receive. You can pick single events or whole groups. You can also set an optional item-type filter and a spaces filter. See Subscriptions and filters. An endpoint with nothing selected receives nothing.

Copy the endpoint secret. It is a 64-character hex string. You use it to verify signatures. You can reveal, copy and roll it at any time.

Use Test send to send a sample of any event to your endpoint.

Limits and requirements

Item	Rule
Endpoints	Up to 10.
URL	Use an `https://` URL. Private, internal and single-label hosts are refused, and the URL is checked again before every send.
Response	Answer with any 2xx status within 10 seconds.

The request body

Every delivery is a JSON object with the event data and some details about the delivery.

Example

{
  "event": "event.registered",
  "timeStamp": 1792600000000,
  "data": {},
  "id": "evt_<uuid>",
  "code": 302,
  "group": "events",
  "version": "2026-10-21",
  "communityId": "<id>",
  "occurredAt": "2026-10-21T15:00:00.000Z",
  "attempt": 1,
  "isTest": false
}

Keys

Key	Meaning
`event`	Event name, for example `user.joined`.
`timeStamp`	Unix time in milliseconds when this attempt was sent (`occurredAt` is when the action happened).
`data`	The event payload. Its shape depends on the event (see the event reference).
`id`	Unique event id (`evt_...`). The same id is used for every retry and resend.
`code`	Numeric event code.
`group`	Event group key, for example `events`.
`version`	Webhook API version.
`communityId`	The community the event belongs to.
`occurredAt`	When the event happened (ISO 8601, UTC).
`attempt`	Delivery attempt number, starting at 1.
`isTest`	`true` for test sends.

Compatibility

event, timeStamp and data are unchanged from earlier versions. For the original 11 events, every existing key in data is kept. Keys may be added, never removed or renamed.

Subscriptions and filters

Each endpoint chooses which events it receives, either one event at a time or by group.

When an endpoint receives an event

An endpoint receives an event when:

the event name is selected, or

the event's group is selected. This includes events added to the group later.

Nothing selected means nothing is sent. An endpoint with no events and no groups can be saved, verified and test-sent, but it receives no deliveries until you choose events or groups.

A group subscription includes events added to that group in the future. Always ignore event types you do not handle, and answer 2xx for them.

Optional filters

Filter	Effect
`spaceIds`	Only events from the chosen spaces. Events that belong to no space (community-level events) are always delivered. No spaces selected means events from every space.
`itemTypes`	Only events whose item type matches (post type, media type or product type), for events that have one.

Headers

Every delivery includes these HTTP headers.

Header	Value
`x-networked-signature`	`t=<unix seconds>,v1=<hex>`. See Verify signatures.
`x-networked-event`	Event name.
`x-networked-event-id`	Same as `id` in the body.
`x-networked-event-code`	Event code.
`x-networked-delivery-id`	Id of this delivery.
`x-webhook-signature`	Legacy signature.
`x-webhook-timestamp`	Legacy timestamp.

Verify signatures

Check the signature on every request to be sure it came from Networked and was not changed.

Use the raw request body, exactly as received. Do not parse and re-serialise it before verifying.

Recommended: `x-networked-signature`

The header looks like this:

x-networked-signature: t=<unix seconds>,v1=<hex>

v1 is the hex HMAC-SHA256 of "<t>.<raw body>" using your endpoint secret. Because it covers the timestamp, a captured request cannot be replayed later.

For 24 hours after you roll the secret, the header carries two v1= values (signed with the new and the old secret). Accept the request if any of them matches.

Rolling the secret switches the legacy x-webhook-signature to the new secret immediately. Only x-networked-signature carries the 24-hour overlap.

Reject the request if |now - t| is more than 300 seconds.

Compare with a constant-time function.

Node.js

Python

PHP

Legacy: `x-webhook-signature`

Unchanged from earlier versions. x-webhook-signature is the hex HMAC-SHA256 of JSON.stringify(data) (the data value only) using the secret. x-webhook-timestamp is the timestamp header. The legacy signature does not cover the timestamp, so use x-networked-signature for new integrations.

Retries and endpoint health

Networked retries failed deliveries and disables endpoints that keep failing.

Delivery and retries

The timeout is 10 seconds. Any 2xx response means delivered.

Other responses and network errors are retried at about 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours and 24 hours (with jitter).

After the last retry, the delivery is marked failed.

Disabled endpoints

Situation	What happens
`410 Gone` response	The endpoint is disabled immediately.
3 days of consecutive failures	The endpoint is disabled and the community admins are emailed once.

Order and duplicates

Delivery order is not guaranteed. Use occurredAt to order events. Use the event id to de-duplicate, because retries and resends carry the same id.

Test sends and the delivery log

Use test sends to try your endpoint, and the delivery log to see what happened to each delivery.

Test send

From the admin API page, send a sample of any event to an endpoint. The body has isTest: true. Test sends are free.

Delivery log

The delivery log keeps the last 30 days per endpoint. Each entry shows:

event

code

time

status

HTTP status

duration

attempts

You can:

filter by status and event

view the body that was sent

resend one delivery

resend all failed deliveries in a time range

Held deliveries that expire are shown as expired in the log. See Tokens and webhooks.

Tokens and webhooks

Delivered webhooks use your community's tokens.

How tokens are used

Each delivered webhook uses 1 token.

A delivery is charged once, when it first succeeds.

Retries, resends of an already delivered webhook, test sends and failed deliveries are free.

When you run out of tokens

If the community is out of tokens, deliveries are held, not sent.

Held deliveries are delivered, oldest first, when the community is unblocked.

Held deliveries older than 30 days expire. They show as expired in the delivery log.

Best practices

Follow these tips to build a reliable webhook receiver.

Respond 2xx fast and process later. Answer within 10 seconds, then do the real work asynchronously.

Verify every request. Check x-networked-signature against the raw body. See Verify signatures.

De-duplicate on the event id. Retries and resends carry the same id.

Do not rely on order. Delivery order is not guaranteed. Use occurredAt to order events.

Ignore unknown event types and unknown keys. Keys may be added, never removed or renamed. Answer 2xx for events you do not handle.

Make retries safe. Handle the same event more than once without side effects.

Keep the secret out of client code. Store it only on your server.

Roll the secret if it leaks. For 24 hours the new and old signatures are both accepted in x-networked-signature.

Use the delivery log after an outage. Check failed deliveries and resend them.

Use isTest. Keep test sends out of your production data.

Choose how you subscribe. Subscribe by group to get new events automatically. Subscribe by event to get a fixed set.

Webhooks changelog

This page lists changes to webhooks, newest first.

2026-10-21

Behaviour change: an endpoint with no events and no groups selected no longer receives every event. It receives nothing until you choose events or groups. Endpoints set up before this version with an empty selection stop receiving events.

New:

New envelope keys beside event, timeStamp and data: id, code, group, version, communityId, occurredAt, attempt, isTest.

98 events in 12 groups. Subscribe by event or by group.

Several endpoints per community (up to 10), each with its own secret, item-type and space filters and status.

Failed deliveries are retried. There is a 30-day delivery log with resend, and test sends.

Every event has a unique id, kept across retries and resends.

New x-networked-signature header that includes the timestamp, plus x-networked-event, x-networked-event-id, x-networked-event-code and x-networked-delivery-id. The legacy x-webhook-signature and x-webhook-timestamp are unchanged.

Secrets can be rolled. x-networked-signature carries both signatures for 24 hours. The legacy x-webhook-signature switches to the new secret immediately.

Delivered webhooks use tokens (1 token each).

Fixes:

event.created and event.updated are now sent. They were defined before but never sent.

user.joined is now sent once, when the membership becomes active. It is no longer sent before payment or ID verification, again for people already in the community, or for the admin added to a space they create. It is now sent when a paid join completes or an ID check passes.

post.created is now sent only when the post is visible, for every post type, including polls, surveys, event posts, shared posts and opportunity posts. Posts waiting for approval send post.approval.requested instead.

user.profile.updated is now sent from every profile save path.

Overview#

What you can build#

Event groups#

Set up a webhook endpoint#

Steps#

Limits and requirements#

The request body#

Example#

Keys#

Compatibility#

Subscriptions and filters#

When an endpoint receives an event#

Optional filters#

Headers#

Verify signatures#

Recommended: x-networked-signature#

Node.js#

Python#

PHP#

Legacy: x-webhook-signature#

Retries and endpoint health#

Delivery and retries#

Disabled endpoints#

Order and duplicates#

Test sends and the delivery log#

Test send#

Delivery log#

Tokens and webhooks#

How tokens are used#

When you run out of tokens#

Best practices#

Webhooks changelog#

2026-10-21#