Webhooks

Outbound webhooks are delivered through the Automation system: you subscribe a target URL to a trigger name with POST /automation/webhooks/subscribe, and the platform POSTs a signed event whenever it fires. This page is a short pointer - the full contract lives on the canonical pages linked below.

Headers & signing

Each delivery includes:

• X-UGC-Signature - hex HMAC-SHA256 of the raw JSON body, keyed with the hookSecret returned at subscribe time
• X-UGC-Event-Id - unique event id, for idempotent processing on retries

Verify against the raw request body (not a re-parsed/re-serialized copy) using a timing-safe comparison.

Payload shape

{
  "id": "evt_...",
  "trigger": "campaign_funded",
  "timestamp": "2026-08-28T10:15:00.000Z",
  "data": { "...": "..." }
}

Event catalog

31 REST-hook trigger names cover campaign/slot/earnings/withdrawal/AI/storage lifecycle plus checkout/subscription/username billing rails - see the full trigger table. The Developer Console webhook picker lists 19 UGC-focused events (campaign, slot, earnings, withdrawals).

Best practices

• Return 200 quickly; process asynchronously in a worker.
• Dedupe on id / X-UGC-Event-Id - deliveries retry with backoff on non-2xx responses.
• Never trust an unsigned or mismatched-signature delivery.

Testing locally

ngrok http 3000
# subscribe using the ngrok URL as targetUrl, e.g. https://abc123.ngrok.io/webhooks/ugc

Troubleshooting

Not receiving events? Confirm the subscription exists via GET /automation/webhooks/subscriptions, that your URL is publicly reachable over HTTPS, and that the trigger actually fired (check Automation triggers).

Signature mismatch? Verify against the exact raw request body (not a re-parsed copy), and that you're using the hookSecret returned at subscribe time, not a different key.

→ [Automation API](/api/automation) · [Trigger reference (31)](/api/automation/triggers) · [Action reference (7)](/api/automation/actions)