Webhooks

Webhooks let another system hear about changes to the plan without asking runorder over and over. When an event changes, a signed JSON POST goes to the address you gave.

This is integration plumbing, not notification for people. If someone should get an email, that belongs under Notifications.

Setting up a subscription

Add subscription asks for four things:

• Endpoint URL — the address that receives the POSTs.
• Scope — Global (all events in this org) or Per-production, where you pick which one.
• Event allow-list — a pipe-separated list, for example event.created|event.updated. Leave it empty to receive every type.

The URL must be HTTPS. Plain http:// is refused, and so are hostnames pointing at an internal or private network — either would leave payloads exposed in transit.

The secret is shown once

When the subscription is created you are given a secret. It is shown only that once. The receiver uses it to verify the X-runorder-Signature header, which is HMAC-SHA256(secret, body).

Save the secret immediately

Close the page without keeping it and there is no way back to the value. The subscription has to be created again.

Testing and switching off

Test fire dispatches a test event to the receiver so you can confirm it arrives before trusting the setup. The confirmation tells you to check the receiver’s logs — runorder does not guess whether the other side was happy.

Each subscription shows Last fired with a timestamp and status code. Disable stops delivery without discarding the setup; Enable resumes it. Delete removes the subscription entirely.