Project Webhooks

Projects webhooks use the shared Leenops delivery engine and may be workspace-wide or scoped to one project.

Configure

Use the Projects webhook settings to provide:

• an HTTPS URL;
• one or more event names;
• an optional project scope;
• an enabled state;
• a secret of at least 16 characters, or an auto-generated secret.

The current settings action recognizes the following intended event names:

• issue.created
• issue.updated
• issue.status_changed
• issue.assignee_changed
• issue.deleted
• comment.added
• project.updated
• webhook.test

Signed request

Every attempt includes:

X-Leenops-Signature: sha256=<hex>
X-Leenops-Timestamp: <unix-seconds>
X-Leenops-Event: <event-name>
X-Leenops-Delivery-Id: <delivery-uuid>
X-Leenops-Module: projects

Compute HMAC-SHA256 over:

<timestamp-seconds>.<raw-json-body>

using the webhook secret. Compare the sha256=<hex> value in constant time, reject stale timestamps, and deduplicate using the delivery ID. The Support webhook guide includes a Node.js verifier for this shared signature contract.

Delivery behavior

• 2xx marks the delivery successful.
• 429, 5xx, network errors, and the 10-second timeout are retryable.
• Other 4xx responses are permanent failures.
• The engine allows four attempts total and records retry due times at 1, 5, and 30 minutes.
• With a daily worker, a retryable row may wait until the next daily drain even after its due time.

Test checklist

1. Use a disposable project and webhook.
2. Send webhook.test and verify headers/signature.
3. Subscribe to the exact emitted event string for the write path under test.
4. confirm a queue/delivery row appears.
5. return 2xx promptly.
6. confirm duplicate delivery IDs are handled safely.

Related documentation

• Projects REST API
• General webhook contract
• Projects AI and MCP Tools