How webhooks work

A webhook is an HTTPS address you own. When something you asked about happens, IT Bible sends a POST request to it with a JSON body describing what happened. Your server answers with any 2xx status to say it got the message.

What a request looks like

Every request has the same shape.

POST /your/endpoint HTTP/1.1
Content-Type: application/json
User-Agent: IT Bible webhooks
X-Webhook-Event: member.lab_completed
X-Webhook-Delivery: 6f1c1d1e-2b7a-4a0e-9a53-0a4f0f5d6c11
X-Webhook-Timestamp: 1782000000
X-Webhook-Signature: sha256=3b1f...e9

{"id":"6f1c1d1e-2b7a-4a0e-9a53-0a4f0f5d6c11","event":"member.lab_completed","created_at":"2026-10-30T14:03:11+00:00","data":{ ... }}

Part	What it is
id	A unique id for this delivery. It is the same on every retry, so you can use it to ignore a repeat.
event	The name of the event, such as member.lab_completed.
created_at	When the event was recorded, as an ISO 8601 time.
data	Details of the event. Each event is described in Events and payloads.
X-Webhook-Event	The event name again, so you can route a request before you read the body.
X-Webhook-Delivery	The same value as id.
X-Webhook-Timestamp	When the request was signed, as seconds since 1970.
X-Webhook-Signature	sha256= followed by the signature. See Verifying a request.

Answering a request

Answer with any 2xx status as soon as you have stored the event. Do the slow work after you have answered. IT Bible waits 5 seconds to connect and 10 seconds in total, and then treats the request as failed.

Redirects are not followed. Give the final address.

Retries

A request is retried when your server cannot be reached, takes too long, or answers with anything other than 2xx. IT Bible tries up to 5 times in all, waiting 1 minute, then 5 minutes, then 30 minutes, then 2 hours between attempts. After the fifth failure the delivery is marked failed and is not sent again.

An address that is not a public web address (for example one that points at a private network) fails at once without retries. The reason is shown in the delivery list.

Because of retries, your server can receive the same event more than once. Use id to recognize a repeat. Events are not guaranteed to arrive in the order they happened, so use created_at if order matters.

Delivery history

Each webhook keeps a list of recent deliveries with their status (waiting, delivered or failed), the HTTP status your server gave and the number of attempts. Records are deleted after 30 days.

Turning a webhook off

A webhook that is turned off gets nothing new. Deliveries that were already waiting are marked failed. You can turn it back on at any time, but events that happened while it was off are not sent afterward.

Privacy

A team webhook only reports people who are on the team. It names the member by their public user name and profile address and never includes an email address. Members are told on the team page when their team has a webhook that is switched on.