Webhooks

Hear about publishes, tour completions and survey answers

Cueston sends a signed POST to your server when something happens in your workspace or in your app. Pick the events each endpoint gets.

Zacznij za darmoRead the docs
A content.published event
{
  "id": "evt_…",
  "type": "content.published",
  "createdAt": "2026-10-26T09:30:00.000Z",
  "workspaceId": 42,
  "data": {
    "contentType": "tour",
    "contentId": 318,
    "name": "Invoice flow",
    "environment": "production",
    "version": 7,
    "versionId": 1290,
    "publishedBy": { "userId": 12, "email": "ada@acme.com" },
    "rollback": false
  }
}

Zaufało nam ponad 200 rosnących firm SaaS

  • FreshTricks
  • Geek Dynamic
  • Kiteframe
  • Morrowbit
  • Ochreline
  • Tandemly

What you get

  • Signed requests

    Every request has a Cueston-Signature header: an HMAC-SHA256 with a timestamp, so you can reject forged and replayed requests.

  • Retries built in

    A failed delivery is retried after 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours.

  • A log you can replay

    Each endpoint keeps 30 days of deliveries. Resend any of them with the same event id.

How it works

From an idea to live guidance, without waiting on a release.

  1. Add an endpoint

    In Settings → Integrations → Webhooks, add an https URL and pick the events. Or use POST /api/webhooks.

  2. Store the signing secret

    The whsec_… secret is shown once. Keep it on your server.

  3. Verify and respond

    Check the signature on the raw body and return any 2xx within 10 seconds. Do slow work after you respond.

  4. Send a test event

    Send test event delivers a signed webhook.test right away and shows the result.

What's included

Publishing events
content.published (also on rollback) and content.unpublished, for tours, tooltips, banners, checklists, surveys and announcements.
Review events
publish_request.created, publish_request.approved and publish_request.rejected.
End-user events
guidance.completed, guidance.dismissed with the step and reason, and survey.answered with every answer and the NPS score.
Team events
member.joined, with the source: invite, single sign-on or SCIM.
Secret rotation without downtime
After a rotation, requests carry signatures from both the new and old secret for 24 hours while you deploy.

Questions

The event `id` stays the same across retries and redeliveries. Use it to ignore duplicates.

See it on your own product

Get a short walkthrough of Cueston on your app, or start free and build your first one today.

Book a demoZacznij za darmo