Integrations: outbound webhooks

Settings → Integrations (address /app/settings/integrations) sends events from this workspace to a URL of yours, for example an automation tool (Zapier, Make, n8n) or your own server. Only Owner and Admin can see and change it.

Step by step: add an endpoint

1. Open Settings → Integrations.
2. In Endpoint URL type your endpoint URL, for example https://your-system.example.com/omnibrand-hook. It must be https and reachable on the public internet; otherwise a red line says which ("The endpoint address must start with https://. Plain http:// is not accepted.", or that it cannot be reached from the internet).
3. Under Events tick the events this endpoint receives. Each box has a plain description and the event's name, for example post.published ("A post was published"), post.failed, social_account.token_expired or social_account.disconnected; All events, including ones added later is *. workspace.created and invitation.accepted are there too. Tick at least one, or the form says "Pick at least one event."
4. Click Add endpoint.
5. Signing secret (copy now - shown only once): appears with the secret, above the form; the page scrolls up to it so you see it on a phone too. If the endpoint is refused, the red message appears in the same place and the page scrolls to it. Copy the secret into your receiving system now; OmniBrand never shows it again (only its last four characters). Copy secret next to it copies it for you.
6. Click Send test on the endpoint. You see ✓ delivered with the HTTP status your server returned. When it fails you see "Not delivered: your server answered [status]." with what to fix, for example for 405 Method Not Allowed "It must accept POST requests at this address.", for 404 Not Found "Nothing answers at this address. Check the URL.", for a redirect "It redirected to another address, and webhooks never follow redirects. Register the final URL instead."; or, when the server could not be reached at all, "Not delivered: your server could not be reached ([reason]). Check the URL and that the server is online." A How webhooks work link opens this article.

Each endpoint

• The URL and a badge active or disabled.
• "events: … · secret ••••1234", with each event by its description (for example "A post was published"), plus "· N consecutive failures" when delivery attempts are failing and "· N waiting for a retry" while events wait for their next try.
• A red line "N failed deliveries - open Delivery history to send them again." when events gave up (see Delivery history and Redeliver below).
• The switch Enabled / Disabled pauses or resumes deliveries. While the change is saved the card says "Working…" and its Send test and Delete wait; if the switch or Delete fails, the reason appears in red at the bottom of that endpoint's card, and the page scrolls to it.
• Send test sends an event named webhook.test once (it is not retried and not kept in the history).
• Delivery history opens the endpoint's recent deliveries (button Hide delivery history closes them).
• Delete asks "Delete the webhook to (address)? Events stop being sent to it at once and its signing secret is gone for good. To pause it instead, turn off its switch." The window is titled Delete webhook?; click Delete to remove the endpoint at once, or Cancel to keep it.

What your server receives

A POST with a JSON body: id (the event's id - use it to ignore duplicates), event (for example post.published), occurredAt, and data (the event's details). Headers:

• X-OmniBrand-Signature: sha256= followed by the HMAC-SHA256 of the raw body, keyed with your signing secret.
• X-OmniBrand-Timestamp and X-OmniBrand-Signature-V2: the HMAC-SHA256 of the timestamp, a dot, and the body - use it to reject old replays.

Answer with any 2xx status within 5 seconds.

Retries: how long OmniBrand keeps trying

Every event is saved before it is sent, so nothing is lost if your server - or ours - restarts. When your server does not answer with a 2xx status within 5 seconds (an error, a timeout, a redirect, any non-2xx answer), the event is tried again after about 1 minute, 5 minutes, 15 minutes, 30 minutes, 1 hour, 2 hours, 4 hours, 8 hours and 12 hours - 10 attempts over about 28 hours. Each wait varies by up to 20% so retries do not all arrive at once. Because a retry can arrive after a later event, use id to ignore duplicates and occurredAt to order events.

If all 10 attempts fail, the delivery is marked Failed and stays in the history for 30 days, where you can send it again.

Delivery history and Redeliver

1. On the endpoint, click Delivery history. Recent deliveries lists the last 30 days, newest first.
2. Each row shows a status badge - Delivered, Retrying or Failed - the event name, when it happened, "Attempt N of 10", for Retrying the "next try" time, and for one that did not get through "Last answer:" with what your server answered (for example "HTTP 503" or "No answer within 5 s").
3. Tick Failed only to see only the failed ones; Show older loads more. With none, it says "No failed deliveries in the last 30 days. Deliveries still being retried are not counted as failed." (a Retrying delivery is not failed yet).
4. To send one again, click Redeliver on its row. It is sent at once: you see "Delivered." or "Not delivered yet (answer). It is tried again automatically." - a redelivered event starts a fresh run of 10 attempts.
5. To send all of them again after fixing your server, click Redeliver all failed (shown when there are failed deliveries). You see "N failed deliveries are queued and go out within a minute."

Redeliver needs the endpoint switched on; while it is Disabled the buttons wait and the history says "This endpoint is disabled. Turn its switch on to redeliver." Events that arrive while an endpoint is disabled are not sent or kept.

If something goes wrong

• Redirects are never followed; register the final URL. If yours redirects, the test says "Not delivered: your server answered 301 Moved Permanently. It redirected to another address, and webhooks never follow redirects. Register the final URL instead." (with the status your server sent).
• When every attempt to an endpoint has failed for a whole day (at least 20 attempts in a row), the endpoint is switched to disabled automatically and admins are notified. Its waiting deliveries are marked Failed. Fix the receiver, turn the switch back to Enabled, then open Delivery history and click Redeliver all failed.

API access (for developers)

At the bottom of the page, the card API access (for developers): "Connect OmniBrand to your own systems, Zapier or Make, to create posts, add contacts or read analytics automatically." On the Agency and Enterprise plans it holds your API keys for the public API (see API access). On other plans it says "API access is available on the Agency plan." with a See plans link. Webhooks on this page work on every plan.

Good to know

• An endpoint receives only this workspace's events, plus account-wide events (billing and account events).
• The workspace you are in when you add the endpoint is the one it belongs to.