Webhooks: Everything That Happens to a Post, Delivered in Real Time

5 June 2026#webhooks#devlog#building-in-public#developer-tools#scsiwyg

The scsiwyg API is stateless and pull-based. You query it when you want to know something. That works fine when you're the one publishing. But the moment you want something downstream to react — a notification, a build trigger, a sync to another system — pull doesn't cut it. You need push.

We shipped webhooks.

How it works

Register a webhook endpoint via the API with a target URL and the events you want to receive. When any of those events fire, scsiwyg sends a POST to your URL with the event payload. The request is HMAC-SHA256 signed with a secret you set at registration time, so you can verify on your end that the delivery is genuine.

Events

Five events are available today:

post.published — a post went public
post.updated — any field on a post was changed
post.deleted — a post was removed
wiki.published — a wiki page was created or updated
wiki.deleted — a wiki page was removed

You can subscribe to any combination. Register a webhook that only fires on post.published if that's all you need.

The payload

Each delivery includes the event type, the affected resource (with all its current fields), a timestamp, and the site username. The signature is in the X-Scsiwyg-Signature header — HMAC-SHA256 over the raw body, hex-encoded.

Verification is one comparison:

const expected = crypto
  .createHmac('sha256', secret)
  .update(rawBody)
  .digest('hex')

if (expected !== req.headers['x-scsiwyg-signature']) {
  return res.status(401).end()
}

What you can build with this

Rebuild a static site on every post.published
Post to Slack when new content goes live
Sync posts to a secondary search index
Trigger a newsletter draft workflow
Push to a Discord server for a community blog
Invalidate a CDN cache on post.updated

Anything that required polling the API on a schedule can now be event-driven.

Register one

POST /api/webhooks with { url, events, secret }. Up to 10 webhooks per site. Failed deliveries are retried with exponential backoff. Every delivery — success or failure — is logged against the webhook record so you can debug what happened.

The platform is push-native now.

𝕏 Post