Webhooks
Send real-time notifications to external services whenever content (or auth) changes in your project.
What is a Webhook?
A Webhook is an HTTP POST emitted by ElmapiCMS to a URL you provide. The payload includes event details and (optionally) the full content record.
Use cases: static-site rebuilds, Slack/Discord, search index sync, serverless automation.
You can also manage webhooks with a project token (admin) via the Webhooks API.
Queue
Webhooks are processed on a queue so failures can retry without blocking the request. See Configuring Queues for Webhooks.
Webhooks List
Each row shows Name, URL, Collections, Events, Sources, Status (enabled flag), and Logs.
Create/edit opens in a side sheet. Click a row to edit.
Creating / Editing a Webhook
| Field | Description |
|---|---|
| Name | Internal label. |
| Description | Optional. |
| URL | HTTPS endpoint to receive POST (HTTP only if WEBHOOK_ALLOW_INSECURE_HTTP=true for local dev). |
| Secret | Optional shared secret for signing. |
| Collections | Limit to specific collections (blank = all). |
| Events | One or many (see below). |
| Sources | cms (dashboard) • api (REST / AI-as-api as appropriate). Auth events typically use api. |
| Include Payload | Include full content JSON in data. |
| Status | Active / Inactive (enabled flag — not content entry state). |
Available Events
| Event | Fires when… |
|---|---|
content.created | Entry created. |
content.updated | Entry updated (including AI updates and translation link/unlink / API link-translation). |
content.trashed | Soft-deleted. |
content.deleted | Permanently deleted. |
content.published | Published (new version minted). |
content.unpublished | Unpublished. |
content.restored | Restored from trash. |
Auth-related events may also be available depending on your Authentication setup; filter with Sources as needed.
Logs
Logs shows deliveries (paginated), responses, and retries.
Security & Retries
- URLs must be HTTPS by default (
WEBHOOK_ALLOW_INSECURE_HTTPfor local HTTP only). - Signed payloads include timing fields such as
timestampanddelivery_id. Validate the signature header with your secret (HMAC SHA-256). - Retries on 5xx / network errors with back-off.
Permissions
| Ability | Purpose |
|---|---|
access_webhooks_settings | Dashboard webhooks UI |
Project token admin | Webhooks REST API |