Register and Manage a Webhook Subscription

Register and Manage a Webhook Subscription

Check API key access, create a webhook, read it back, and update it.

1. Read the API key's own metadata first. This returns the key's permission scopes, which is the cheapest way to confirm the credential can actually write webhook settings before creating a subscription that would otherwise fail halfway throug
2. Register the webhook for the chosen event type. The secretToken supplied here is what Ashby uses to sign every delivery, so it must be stored by the receiver, not discarded.
3. Read the subscription back to confirm it registered against the intended url and event type.
4. Update the subscription. This same call rotates the secret token, moves the delivery url, and disables a subscription without deleting it — the safe way to pause deliveries during receiver maintenance. webhook.delete removes it permanently

What you'll need to have ready

• webhookType: The event type to subscribe to (e.g. applicationSubmit, candidateStageChange, offerCreate, jobPostingPublish).
• requestUrl: The https endpoint Ashby should POST events to.
• secretToken: The shared secret Ashby signs deliveries with. The receiver must verify the Ashby-Signature HMAC-SHA256 header against this value.
• updatedRequestUrl: A new delivery url, when moving or rotating the endpoint.
• enabled: Whether the subscription should remain enabled.

For your developer

Arazzo workflow ashby-hq:webhook-lifecycle, 4 operations: apiKeyInfo → webhookcreate → webhookInfo → webhookupdate. Specs on APIs.io.