Webhooks

A webhook sends an event to an address of yours as soon as it happens: a deploy that succeeded or failed, an incident that opened or resolved, or an approval that is waiting. Use it to post to your own chat, page someone, or start your own automation.

Add an endpointCopy Anchor Link

1. Go to Settings, then Developer, and find Webhooks.
2. Choose Add endpoint, and enter the Endpoint URL. It must be a public https:// address.
3. Tick the Events to send, and choose Add endpoint.
4. Copy the signing secret GetFlowing shows you. It is shown only once.

Only owners and admins can add, switch off, test or remove endpoints. To change an endpoint's address or events, add a new one and remove the old one. Each endpoint has an Active switch, shows when it last received a delivery and with what status, and has a Test button that sends it a signed ping event.

EventsCopy Anchor Link

What a delivery looks likeCopy Anchor Link

Each delivery is an HTTPS POST with a JSON body:

{
  "id": "the event's id",
  "type": "deployment.failed",
  "createdAt": "2026-11-13T10:24:05.000Z",
  "data": { "...": "what happened, depending on the event" }
}

It carries two headers: X-Getflowing-Event, the event's type, and X-Getflowing-Signature, its signature.

Check the signatureCopy Anchor Link

Before you act on a delivery, check it came from GetFlowing. Work out the HMAC-SHA256 of the request's raw body, exactly as received, with your endpoint's whole signing secret, exactly as shown, as the key. Write it in hex, put sha256= in front, and compare it with X-Getflowing-Signature.

// Node
import { createHmac, timingSafeEqual } from 'node:crypto';

function fromGetFlowing(rawBody, signature, secret) {
  const expected = 'sha256=' + createHmac('sha256', secret).update(rawBody).digest('hex');
  const a = Buffer.from(String(signature ?? ''));
  const b = Buffer.from(expected);
  return a.length === b.length && timingSafeEqual(a, b);
}

Compare the raw body, before any JSON parsing, or the signature will not match.

Good to knowCopy Anchor Link

• Answer quickly, with a 2xx status. A delivery that takes longer than 10 seconds counts as failed.
• GetFlowing sends each event once and does not retry it. The dashboard keeps the full record, and Test checks your endpoint at any time.
• If a delivery arrives with an id you have already handled, ignore it.
• Redirects are not followed. Use the endpoint's final address.