Webhooks

A webhook is an HTTPS POST that HotCodePush sends to your URL each time a subscribed event happens, such as a release created. Webhooks belong to an organization and are managed by its Admins and Owners. They are sent only where its plan includes them. Billing and MAU lists what each plan includes.

• Events and payload lists every event type a webhook can deliver and the JSON body each one carries.
• Signature and retries explains how to verify HotCodePush-Signature, when a failed delivery is retried and when a webhook is disabled.

The chat formats have a guide each under Integrations.

FormatsCopy Anchor Link

Every format carries HotCodePush-Delivery-Id, and only raw carries HotCodePush-Signature. The format is fixed at creation. The Slack, Discord and Microsoft Teams guides set up the chat's side.

A slack, discord or teams delivery posts one message. Its first line is an emoji and the title in bold, ✅ Release #42 created. Then come Organization, App where the event has one, and each snapshot field as Label: value, cut at 200 characters.

Subscribing to bundle.uploaded beside release.created doubles the messages in a chat channel.

Create a webhookCopy Anchor Link

Create a webhook on the organization's Webhooks page in the console, with hotcodepush webhook create or with organizations.webhooks.create in the Node.js or Python client, each with a signed-in session. A webhook has a name, unique in the organization, a format, an https URL that is neither a loopback nor a private address, and one or more event types. An optional app filter limits it to that app's events. The exact rules of each field are on the webhook operations of the Swagger reference.

A raw webhook's secret, whsec_…, is shown once at creation. To rotate it, create a second webhook and delete the first. The format and the secret never change, while the name, the URL, the events, the app filter and isEnabled do, through an update.

The test eventCopy Anchor Link

The Test action in the webhook's Actions menu, or hotcodepush webhook test, sends one sample event through the webhook and answers with your endpoint's response. A raw one is signed. Its type is webhook.test and its snapshot is the webhook itself:

{
  "actorType": "system",
  "appId": null,
  "createdAt": "2026-10-20T14:05:40.102Z",
  "id": "3b2a1c0d-9e8f-4a7b-8c6d-5e4f3a2b1c0d",
  "objectId": "d0c1b2a3-f4e5-4d6c-b7a8-9f0e1d2c3b4a",
  "organizationId": "0b1c2d3e-4f50-4617-8293-a4b5c6d7e8f9",
  "snapshot": {
    "events": ["release.created", "release.revoked"],
    "format": "raw",
    "name": "Deploy bot"
  },
  "type": "webhook.test",
  "userId": null
}

A disabled webhook is tested all the same, and the outcome counts toward its failure streak.

The delivery logCopy Anchor Link

Every delivery is listed newest first on the webhook's deliveries page in the console and with hotcodepush webhook-delivery list, for the retention period. An entry shows the event's type, whether the delivery is pending, succeeded or failed, the attempts, the receiver's last answer cut short, and when the next retry is due. The fields are on the deliveries operation of the Swagger reference.

The Redeliver action in the delivery's Actions menu, or hotcodepush webhook-delivery redeliver, sends the event once more with the same HotCodePush-Delivery-Id and writes delivery.redelivered to the audit log.