> For the complete documentation index, see [llms.txt](https://docs.codemash.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.codemash.io/cloud/project/settings/webhooks.md).

# Webhooks

**Where:** Project → Settings → Webhooks · `/projects/<project>/settings?tab=Webhooks`

Push event notifications from this project to HTTP endpoints you own. Every delivery is a signed JSON envelope POSTed to each destination subscribed to the event. The project has **one** webhook integration — a shared signing secret, shared extra headers, and any number of destinations. A badge shows whether it is **Configured** (the signing secret exists) or **Not configured**; you can define destinations either way, but deliveries only start once the secret is generated.

{% hint style="info" %}
Screenshot TODO — capture comes from testing-plan area **17-project-settings**.
{% endhint %}

## Signing secret

One secret, shared by every destination on the project. Subscribers verify the `X-Norbix-Signature` header by computing HMAC-SHA256 of `{timestamp}.{body}` with this secret; the timestamp comes from the `X-Norbix-Timestamp` header.

* **Generate** — provisions the secret the first time (turns the badge to Configured).
* **Reveal** — shows the current secret so you can copy it into your subscriber.
* **Regenerate** — after a confirmation: the current secret stops working immediately, and every subscriber must be updated with the new one.

## Extra headers

Static headers added to every delivery from this project — for example an auth header your receiver expects. They are merged with each destination's own headers; the destination's header wins on conflict. Press **Save Headers** to apply.

## Destinations

The endpoints that receive events. Each row shows the name, URL, subscribed events, an **Enabled** toggle (pause without deleting) and a **Change** link. **Add Destination** opens the same form:

| Field             | What it does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Display name      | How the destination is listed, e.g. `Billing service`. Required.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| Endpoint URL      | Full http(s) URL that receives the POSTed envelope, e.g. `https://example.com/hooks/norbix`. Required and validated as a URL.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Subscribed events | Checkboxes grouped by module — only the selected events are delivered. **Database:** `database.record.inserted`, `database.record.updated`, `database.record.deleted`, `database.record.replaced`, `database.record.responsibilityChanged`, `database.records.inserted`, `database.records.updated`, `database.records.deleted`. **Membership:** `membership.user.registered`, `membership.user.invited`, `membership.user.verified`, `membership.user.updated`, `membership.user.deleted`, `membership.user.blocked`, `membership.user.reactivated`. **Files:** `files.file.uploaded`, `files.file.deleted`. |
| Extra headers     | Headers sent only to this destination, on top of the integration-wide ones (destination wins on conflict).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| Enabled           | Turn the destination on or off without deleting it.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |

In edit mode the form also has a red **Delete…** button; after the confirmation, deliveries to that endpoint stop immediately.

### Example

A destination `Billing service` pointed at `https://billing.example.com/hooks/norbix`, subscribed to `database.record.inserted` and `membership.user.registered`: when a user registers, Norbix POSTs the signed envelope there, and your receiver recomputes the HMAC with the shared signing secret before trusting the payload.

## API reference

Endpoints: [Webhooks](/api-reference/webhooks.md).