Outgoing webhooks

Stream PR events out of DevPulse into Zapier, Make, n8n, Jira, Linear — anywhere that accepts an HTTP POST.

How they fire

After DevPulse writes an event to the database, it fans out to every matching subscription. Failed deliveries are retried with exponential backoff (1m, 2m, 4m, …, up to 12 hours, 8 attempts max).

Setting up a subscription

1. Open your workspace → Settings → Outgoing webhooks
2. Enter a name and target URL
3. Pick the event types (opened, approved, merged, deployed)
4. Save — DevPulse generates a random shared secret for signature verification

Request format

POST <your URL>
Content-Type: application/json
X-Signature: sha256=<HEX>
X-Event: merged

{
  "workspace_id": "uuid",
  "event_id": 123,
  "action": "merged",
  "ticket_id": "WEB-1142",
  "pr": {
    "id": 42,
    "url": "https://github.com/...",
    "provider": "github",
    "status": "merged",
    "deployed_env": null
  },
  "occurred_at": "2026-05-16T13:01:00Z"
}

Verifying the signature (Node.js example)

import { createHmac, timingSafeEqual } from "crypto";

function verify(secret, headerSig, rawBody) {
  const expected = "sha256=" + createHmac("sha256", secret)
    .update(rawBody).digest("hex");
  const a = Buffer.from(expected), b = Buffer.from(headerSig);
  return a.length === b.length && timingSafeEqual(a, b);
}

Best practices

• Respond within ~5 seconds. DevPulse treats anything non-2xx as a failure and retries.
• Use the event_id for idempotency on your side — Slack sometimes retries, so you may see the same event_id twice.
• Filter by action on your end if you only care about a subset.