Configuring Webhooks

Webhooks allow Guidevera to send an HTTP POST notification to an external URL whenever a specific event occurs. This can be used to trigger CI pipelines, notify chat systems, or integrate with other tools. Requires enableWebhooks to be enabled. Accessible to Admins only.

Supported events

• page.updated — fired when a page is saved (includes page ID and title)
• page.reviewed — fired when a review decision is made (includes page ID and decision)
• * — wildcard, receives all events

Adding a webhook

Open the webhook settings from the admin menu. Enter the target URL and select the events to subscribe to. Optionally add a secret — if set, each request includes an X-Webhook-Signature header containing an HMAC-SHA256 signature of the request body signed with the secret. Use this to verify that requests come from Guidevera.

Payload format

Each webhook request is a JSON POST with the following structure:

{
  "event": "page.updated",
  "timestamp": "2026-03-17T10:00:00+00:00",
  "data": { "page_id": 42, "title": "My Page" }
}

Delivery and security

Webhooks are delivered asynchronously via a queue in tmp/webhook_queue/ processed by the webhook-worker command. Only HTTPS URLs are accepted in production. Internal IP addresses and localhost are blocked to prevent SSRF attacks. DNS is resolved once and pinned to prevent DNS rebinding.

Enabling webhooks

Webhooks are controlled by enableWebhooks in config/app.php. See Application Settings.