Webhooks

Inbound provider webhooks

These routes receive callbacks from external providers. They are not called by your integration.

Stripe

Stripe webhook routes process platform and connected-account payment events:

POST /webhooks/stripe/platform
POST /webhooks/stripe/connect

These endpoints verify Stripe signatures, record webhook events, update checkout state, and trigger entitlement changes.

Mailgun

Mailgun events update email delivery status:

POST /webhooks/mailgun/events

AssemblyAI

AssemblyAI transcription callbacks update media transcription state:

POST /api/v1/media/webhooks/assemblyai

Outbound webhook nodes (automations)

The automations engine ships a webhook node that POSTs a signed JSON payload to an endpoint you register. This is the current outbound webhook surface for customer integrations. Webhook endpoints are hub-scoped and managed via:

POST   /api/v1/teams/{team_id}/hubs/{hub_id}/webhook-endpoints       create endpoint
GET    /api/v1/teams/{team_id}/hubs/{hub_id}/webhook-endpoints        list endpoints
DELETE /api/v1/teams/{team_id}/hubs/{hub_id}/webhook-endpoints/{id}   delete endpoint

Each endpoint has a signing secret (generated server-side if not supplied, encrypted at rest, never returned). Targets are validated against an SSRF guard — private, loopback, link-local, and cloud-metadata addresses are rejected. Delivery is asynchronous with exponential-backoff retries. When the webhook node fires inside an automation it POSTs a payload containing the automation context and enrollment metadata to your registered URL. Use the signing secret to verify the X-Mio-Signature-V1 header on your receiver, as described below. See the Automations guide for the full node reference and lifecycle.

Delivery headers

Every delivery carries these headers:

Header	Value
`X-Mio-Signature-V1`	`v1=` followed by the lowercase hex HMAC-SHA256 of `{X-Mio-Timestamp}.{raw body}`, keyed by the endpoint’s signing secret. Verify this one.
`X-Mio-Timestamp`	Unix time in seconds when this attempt was sent, as ASCII digits.
`X-Mio-Delivery-Id`	A stable id for the delivery. It stays the same across retries of the same delivery.
`X-Mio-Signature`	Deprecated. `sha256=` followed by the hex HMAC-SHA256 of the raw body only. It doesn’t cover the timestamp, so a captured request can be replayed with a new `X-Mio-Timestamp` and still match. It’s still sent so existing receivers keep working, and it will be removed after a deprecation window.

Each retry is sent with a new X-Mio-Timestamp and a new X-Mio-Signature-V1. Retries happen only on a timeout, a network error or a 5xx response. A 4xx response from your receiver is final, and that delivery is not retried. Request bodies over 1 MiB are truncated to 1 MiB before sending, and both signatures cover the truncated bytes you receive.

Verifying a delivery

On every request:

Read the raw request body as bytes, before any JSON parsing. Re-serialized JSON won’t match.
Check that X-Mio-Timestamp is only ASCII digits, and reject the request if it’s 300 seconds or more away from your clock, in either direction.
Compute HMAC-SHA256(signing_secret, timestamp + "." + raw_body) using the exact X-Mio-Timestamp string you received, and format it as v1= plus lowercase hex.
Compare it with X-Mio-Signature-V1 using a constant-time comparison, never ==.
Deduplicate on X-Mio-Delivery-Id. A byte-for-byte copy of a delivery still verifies inside the 300-second window, and a retry can arrive after an earlier attempt you already processed.

import hashlib
import hmac
import re
import time

TOLERANCE_SECONDS = 300

def verify_mio_webhook(secret: str, raw_body: bytes, timestamp: str | None, signature: str | None) -> bool:
    if not secret or not timestamp or not signature:
        return False
    if not re.fullmatch(r"[0-9]{1,15}", timestamp):
        return False
    if not re.fullmatch(r"v1=[0-9a-f]{64}", signature):
        return False
    if abs(int(time.time()) - int(timestamp)) >= TOLERANCE_SECONDS:
        return False
    digest = hmac.new(secret.encode(), f"{timestamp}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(f"v1={digest}".encode(), signature.encode())

import crypto from "node:crypto";

const TOLERANCE_SECONDS = 300;

export function verifyMioWebhook(secret, rawBody, timestamp, signature) {
  if (!secret || !timestamp || !signature) return false;
  if (!/^[0-9]{1,15}$/.test(timestamp)) return false;
  if (!/^v1=[0-9a-f]{64}$/.test(signature)) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - Number(timestamp)) >= TOLERANCE_SECONDS) return false;
  const digest = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.`)
    .update(rawBody) // a Buffer holding the raw request body
    .digest("hex");
  const expected = Buffer.from(`v1=${digest}`);
  const received = Buffer.from(signature);
  return expected.length === received.length && crypto.timingSafeEqual(expected, received);
}

If you verify X-Mio-Signature today, switch to X-Mio-Signature-V1. Both headers are sent during the deprecation window, so you can deploy the new check before the old header goes away.

Team-level outbound webhooks (Zapier-style)

General-purpose team-level outbound webhooks (trigger on any platform event, configurable outside of automations) are a planned feature tracked separately. For today’s integrations, use the automation webhook node described above, API polling, or the checkout inspection endpoints.

Hubs

Members and auth

Contacts and audience

Content and pages

Media

Commerce

Community

Email and automations

Analytics

Inbound provider webhooks

Stripe

Mailgun

AssemblyAI

Outbound webhook nodes (automations)

Delivery headers

Verifying a delivery

Team-level outbound webhooks (Zapier-style)

​Inbound provider webhooks

​Stripe

​Mailgun

​AssemblyAI

​Outbound webhook nodes (automations)

​Delivery headers

​Verifying a delivery

​Team-level outbound webhooks (Zapier-style)

Inbound provider webhooks

Stripe

Mailgun

AssemblyAI

Outbound webhook nodes (automations)

Delivery headers

Verifying a delivery

Team-level outbound webhooks (Zapier-style)