Webhooks

The Webhooks page lets you configure outgoing webhooks from flowcy.dev. Whenever an event happens inside flowcy.dev (an agent finishes a session, a release ships, a CI update PR opens), the matching webhooks fire so other systems — your Slack relay, your Datadog ingest, your internal dashboard — can react.

This is outgoing webhooks. flowcy.dev's incoming webhooks from GitHub are wired automatically when you install the GitHub App; you don't need to manage those.

Adding a webhook

Click Add webhook and provide:

• URL — where flowcy.dev should POST events. Must be HTTPS.
• Events — pick which event types should trigger this webhook (sessions, releases, CI updates, etc.). You can subscribe to all or a subset.
• Secret — a shared secret used to sign the payload. Your endpoint should verify the X-Autopilot-Signature header before trusting the body.

Payload format

Each delivery is a JSON POST containing:

• event — the event type (e.g. session.completed, release.triggered).
• data — the event-specific payload.
• timestamp — ISO timestamp of the event.

The X-Autopilot-Signature header is sha256=<hex> where the HMAC is computed over the raw body using your secret. Verify it before processing.

Delivery and retries

Failed deliveries (non-2xx response, timeout, network error) are retried with exponential backoff for up to 24 hours. You can see recent delivery attempts on each webhook's detail page, including the request body, response status, and any error message.

Disabling

Toggle a webhook off to stop deliveries without losing its configuration. Useful when your downstream system is down for maintenance.