Webhooks · Everdeck help

A webhook sends a message from Everdeck to an address on your own server the moment something happens in a company: a task is done, an action waits for someone's approval, or a folio is made public. Use it to update a dashboard, start a job in another system or post to your own chat tool. (To go the other way, turning messages from other apps into tasks, see Intake.)

Who can set them up

Company admins, and account owners and admins. Webhooks belong to one company: each company has its own endpoints, and sees only its own deliveries.

Adding an endpoint

Open Webhooks in the Connect section and select Add endpoint.
Enter the Endpoint address: an https:// address on the standard port (443) that your server answers on. Everdeck doesn't send to local or internal names, private network addresses, or anything but https, and it doesn't follow redirects, so use the address's final form.
Optionally add a Description, so you can tell your endpoints apart.
Under Events to send, choose the events this endpoint should hear about.
Select Add endpoint, and confirm it's you with your second factor if Everdeck asks.

Everdeck then shows the endpoint's signing secret, starting whsec_. Copy it into your server's settings now: it's shown only this once. A company can have up to 10 endpoints.

The events

Event	Sent when	What `data` holds
`task.completed`	A task is done: its result was accepted, or it finished without review	The task, as the API's Task
`approval.requested`	An action waits for someone's approval (each step of a chain sends one)	The request, as the API's Approval, without its steps and decisions
`folio.published`	A folio is made public	The folio, with its public address, as the API's Folio
`webhook.test`	You select Send test	A short message saying it's a test

Every message is a JSON object like this:

{
  "id": "msg_4f0c9a1e2b8d4c6fa1b2c3d4e5f60718",
  "type": "task.completed",
  "timestamp": "2026-10-29T08:00:00+00:00",
  "account_id": "…",
  "company_id": "…",
  "data": { "id": "…", "title": "Close the books", "status": "done", "…": "…" }
}

data is the object exactly as the Everdeck API returns it to a token that can read it, so the same code can read both: see the Task, Approval and Folio objects in the API reference. An approval's waiting_on_me is always false in a message, since a message isn't read by one person. Messages never carry secrets, an approval's arguments, a folio's content, or anything from an agent session's steps. Fetch more through the API if you need it.

A message is at most 240 KB. If an object is bigger, its longest text (a task's description, acceptance criteria or result summary, an approval's preview or reason) is cut short and ends with …, and the message carries "truncated": true next to data. Fetch the object through the API for the full text.

Checking a message came from Everdeck

Each message is signed with Standard Webhooks: it carries a webhook-id, a webhook-timestamp (seconds since 1970) and a webhook-signature. The signature is the base64 HMAC-SHA256 of {webhook-id}.{webhook-timestamp}.{body}, keyed with the base64-decoded part of your secret after whsec_, written as v1,<signature>. Standard Webhooks libraries for most languages check it for you. Also refuse a timestamp more than 5 minutes old, and use webhook-id to skip a message you already handled: the same message can arrive more than once.

Deliveries and retries

Open an endpoint from the Webhooks page to see its deliveries from the last 30 days, newest first, with what your server answered: its status code and the start of its reply. Select View to see the body that was sent.

A delivery your server doesn't answer with a 2xx is tried again 1, 5, 15 and 60 minutes later, then every 6 hours, for up to 24 hours in all. Each try carries the same webhook-id.
Redeliver sends a delivery again at once, with the same webhook-id, and gives it another 24 hours of retries if it fails.
Send test sends a webhook.test message at once and shows what your server answered. A test is tried only once.
Messages to one endpoint can arrive in any order. Use each object's own dates if order matters.
A message can arrive more than once, with the same webhook-id each time. Skip one you've already handled.
A delivery that still hasn't gone through 24 hours after its event (or after you redelivered it) is marked failed, saying it wasn't delivered in time. Everdeck doesn't promise that every event is delivered: if missing one matters, check with the API too.

If an endpoint's deliveries keep failing for 3 days in a row, Everdeck turns it off and tells the company's admins. Fix your server, select Send test to check it, then Turn on. Any delivery that goes through resets the 3 days, and so does a quiet spell: a failure more than 24 hours after the one before it starts the count again. Changing the endpoint's address starts the count again too.

Changing, rotating and deleting

Edit changes the address, the description or the events.
Turn off stops sending at once, and events that happen while it's off aren't queued for it, so it never gets them; Turn on starts again. Deliveries already queued when you turned it off wait, and are sent once it's on again, but they still end 24 hours after their event: one still waiting then is marked failed. Redeliver works only while the endpoint is on, except for a test message, which you can send again while it's off, as you can Send test.
Rotate secret gives the endpoint a new secret, shown once. For 24 hours each message is signed with both the old and the new secret (two v1, entries in webhook-signature), so you can switch your server over without missing any.
Delete removes the endpoint and its deliveries.

Adding, editing, turning on, rotating and deleting ask you to confirm it's you with your second factor if you haven't in the last 15 minutes. Each change is in the company's audit log, which names the endpoint by its host, never its full address or secret.