Webhooks and Integrations

Use this guide to verify the organization's integration posture before changing API, webhook, or runtime settings.

Integrations Overview

Route: /dashboard/organization/integrations

This page is the fastest cross-surface health check for organization automation.

This page summarizes:

• active public API keys
• outbound webhook configuration state
• organization notification stream endpoint
• managed runtime availability and running deployment counts
• recent API keys and subscription/runtime state

Use it before debugging a failing integration because it quickly shows whether the issue is likely:

• missing API credentials
• incomplete webhook setup
• missing subscription/runtime access
• a misunderstanding of which integration surface should be used

Webhooks

Route: /dashboard/organization/webhooks

Use this page to:

• enable or disable outbound delivery
• set the destination URL
• configure an optional signing secret
• send a test webhook
• confirm the currently supported event list

Current supported event:

• notification.created

Delivery Contract

Requests are sent as POST with application/json and include these headers:

• x-obelisk-event
• x-obelisk-delivery-id
• x-obelisk-timestamp
• x-obelisk-signature

If a signing secret is configured, x-obelisk-signature is the HMAC-SHA256 over timestamp.body.

Recommended Receiver Behavior

1. Reject requests missing the required headers.
2. Enforce a timestamp freshness window.
3. Recompute the HMAC and compare in constant time.
4. De-duplicate by x-obelisk-delivery-id.
5. Return a 2xx response only after the payload is accepted by your system.

Related Pages

• API Keys and Public Deployment API
• Webhook And Event Catalog
• Production Readiness
• Support and Escalation