Webhooks: Real-Time Event Notifications for Your Integrations

Webhooks let your external systems react instantly when something happens in your community. Instead of polling the API, Outpost pushes events directly to your endpoint — new topics, member signups, moderation flags, payment events, and more.

Plan requirement: Webhooks are available on Pro (up to 3 endpoints) and Business (unlimited) plans.

Setting Up Your First Webhook

Go to Admin Settings → Webhooks tab
Click Add Endpoint
Fill in the form:
- Endpoint URL — where Outpost will send POST requests (e.g., https://your-app.com/webhooks/outpost)
- Description — optional label for your reference (e.g., "Production Slack integration")
- Events — select which event types to subscribe to
Click Save

On creation, you'll be shown a signing secret (format: opwh_...). Copy and store it immediately — it's only displayed once and is required to verify webhook signatures.

Supported Event Types

Outpost supports 23 event types across five categories:

Content Events

Event	Trigger
`topic.created`	New topic published
`topic.locked`	Topic locked or unlocked
`topic.archived`	Topic archived or unarchived
`topic.deleted`	Topic deleted
`topic.pinned`	Topic pinned
`post.created`	New reply posted
`post.deleted`	Post deleted
`post.liked`	Post liked
`post.reaction`	Emoji reaction added
`post.flagged`	Post flagged for moderation

Member Events

Event	Trigger
`member.joined`	New member joined community
`member.left`	Member left community
`member.suspended`	Member suspended
`member.banned`	Member banned
`member.role_changed`	Member role updated

Calendar Events

Event	Trigger
`event.created`	Event published
`event.signup`	Member registered for event
`event.cancelled`	Event cancelled

Payment Events

Event	Trigger
`paid.subscription_created`	New paid membership started
`paid.subscription_cancelled`	Paid membership cancelled
`paid.payment_failed`	Membership payment failed

System Events

Event	Trigger
`webhook.test`	Manual test from admin panel

Payload Format

Every webhook delivery sends a JSON POST request with this structure:

{
  "id": "delivery-uuid",
  "type": "topic.created",
  "created_at": "2026-03-22T15:30:45Z",
  "community": {
    "id": "community-uuid",
    "slug": "my-community",
    "name": "My Community"
  },
  "data": {
    // Event-specific fields (see below)
  }
}

Example Payloads

topic.created:

{
  "data": {
    "topic_id": "uuid",
    "title": "Discussion Title",
    "category_id": "uuid",
    "author_id": "uuid",
    "slug": "discussion-title"
  }
}

member.joined:

{
  "data": {
    "user_id": "uuid",
    "username": "user@example.com",
    "display_name": "Jane Doe"
  }
}

post.flagged:

{
  "data": {
    "flag_id": "uuid",
    "post_id": "uuid",
    "reporter_id": "uuid",
    "reason": "spam",
    "details": "This looks like automated spam"
  }
}

paid.subscription_created:

{
  "data": {
    "user_id": "uuid",
    "tier_id": "uuid",
    "stripe_subscription_id": "sub_..."
  }
}

Verifying Webhook Signatures

Every request includes an Outpost-Signature header for security verification:

Outpost-Signature: t=1711122645,v1=5257a869e7ecebeda32affa62cdca3fa51cad7e77a0e56ff536d0ce8e108d8bd

To verify:

Extract the timestamp (t) and signature (v1) from the header
Compute the signing key: SHA256(your_raw_secret)
Build the signed payload string: {timestamp}.{request_body_json}
Calculate HMAC-SHA256 of the payload using the signing key
Compare your computed signature with the v1 value

Verification Example (Node.js)

const crypto = require('crypto');

function verifyWebhook(secret, signature, body) {
  const [tPart, vPart] = signature.split(',');
  const timestamp = tPart.replace('t=', '');
  const receivedSig = vPart.replace('v1=', '');

  const signingKey = crypto
    .createHash('sha256')
    .update(secret)
    .digest();

  const expectedSig = crypto
    .createHmac('sha256', signingKey)
    .update(`${timestamp}.${body}`)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(expectedSig),
    Buffer.from(receivedSig)
  );
}

Always use constant-time comparison to prevent timing attacks.

Delivery & Retry Logic

Outpost ensures reliable delivery with automatic retries:

Attempt	Delay	Notes
1st	Immediate	Initial delivery
2nd	5 seconds	First retry
3rd	30 seconds	Second retry
4th	5 minutes	Final retry

Success: Any HTTP 2xx response
Failure: Network error, timeout (10s), or non-2xx status
Response capture: First 1 KB of your response body is logged for debugging

After 4 failed attempts, the delivery is marked as failed and no further retries are made.

Monitoring Deliveries

Each webhook endpoint in the admin panel has an expandable Recent Deliveries section showing the last 25 deliveries:

Column	Description
Status	Color-coded dot — green (2xx), red (4xx/5xx/error), yellow (3xx)
Code	HTTP status code (or "---" if no response received)
Event	The event type that triggered delivery
Duration	Round-trip time in milliseconds
Time	When the delivery was attempted

This gives you full visibility into what's being delivered and whether your endpoint is responding correctly.

Testing Webhooks

Before going live, use the Send Test button on any webhook endpoint. This sends a test payload:

{
  "id": "test-delivery-uuid",
  "type": "webhook.test",
  "created_at": "2026-03-22T15:30:45Z",
  "community": {
    "id": "community-uuid",
    "slug": "your-slug",
    "name": "Your Community"
  },
  "data": {
    "message": "This is a test webhook event from Outpost."
  }
}

Check your endpoint logs and the delivery history to confirm everything is wired up correctly.

Managing Webhooks

From the Webhooks tab in Admin Settings:

Edit — update the URL, description, or subscribed events
Delete — permanently remove the endpoint (with confirmation)
Send Test — fire a test event on demand
View Deliveries — expand to inspect recent delivery attempts

Security Considerations

URL validation: Outpost blocks webhook URLs that resolve to private/internal IP addresses (127.0.0.1, 192.168.x.x, 10.x.x.x, 172.16-31.x.x)
Secret storage: Your signing secret is stored as a SHA-256 hash — Outpost never stores the raw secret
HTTPS recommended: While HTTP endpoints are accepted, HTTPS is strongly recommended for production use
Timeout: Endpoints must respond within 10 seconds or the delivery is marked as failed

Common Integration Ideas

Integration	Events to Subscribe
Slack notifications	`topic.created`, `member.joined`, `post.flagged`
CRM sync	`member.joined`, `member.left`, `member.role_changed`
Analytics pipeline	All content events
Moderation alerts	`post.flagged`, `member.suspended`, `member.banned`
Payment tracking	`paid.subscription_created`, `paid.payment_failed`
Calendar sync	`event.created`, `event.cancelled`, `event.signup`
Custom automation	Any combination — Outpost webhooks work great with Zapier, Make, n8n, or custom backends

Plan Limits

Plan	Max Webhook Endpoints
Free	Not available
Pro	3
Business	Unlimited

Webhooks turn your community into the center of your ecosystem. Wire up your tools, automate your workflows, and react to community activity in real time.