ReleasePad Webhooks

Introduction

A webhook is a URL on your server that ReleasePad calls when something happens to a post. Instead of polling the Management API for changes, you register an endpoint once and ReleasePad sends an HTTP POST to it with the full post as JSON. Typical uses: announce a release in Slack or Discord, kick off an email campaign, sync release notes into a help center or CRM, or trigger an automation in Zapier, Make or n8n.

Webhooks are configured per product. A product can have as many endpoints as you like, and each endpoint picks which of the three events it wants. Every request uses the same envelope, and the post inside it has exactly the same shape as the post object of the Management API, so code that already reads API responses can read webhook payloads unchanged.

Set up an endpoint

Endpoints are managed by an account admin from the product's settings in the dashboard. There is nothing to configure on the API side.

The URL must start with https:// and include a host. Plain http:// endpoints are rejected: post bodies are your release notes, and they never travel unencrypted. To receive events on a machine without a certificate, put it behind a tunnel such as ngrok or Cloudflare Tunnel, which terminates TLS for you and gives you an https URL to register.

Request & headers

Every delivery is a single POST to your URL. The event name travels in two places: the X-ReleasePad-Event header and the event field of the JSON body. They are always identical. The header exists so you can route the request to the right handler, or drop events you do not care about, before parsing the body at all.

How the header is set, action by action:

POST /releasepad HTTP/1.1
Host: hooks.example.com
Content-Type: application/json
User-Agent: ReleasePad-Webhooks/1.0
X-ReleasePad-Event: post.published
Content-Length: 1042

{"id":"0c4337ea-49b3-488f-897a-f130d60ba748","event":"post.published","product_id":20,"created_at":"2026-10-06T22:28:21.548372Z","data":{...}}

There is no request signature and no authentication header. See Security for how to make sure only ReleasePad can call your endpoint.

Payload envelope

The body is the same five fields for every event. Only event and the contents of data change.

{
  "id": "0c4337ea-49b3-488f-897a-f130d60ba748",
  "event": "post.published",
  "product_id": 20,
  "created_at": "2026-10-06T22:28:21.548372Z",
  "data": { ... }
}

The post object

data is the post exactly as the Management API returns it. The body is the stored Markdown, never rendered HTML. Fields you will usually branch on:

The complete field list is documented once, in the API reference.

What fires when

The same rules, as a lookup table. "Two requests" means two separate deliveries, each with its own id, sent one right after the other.

Delivery rules

Handling webhooks

A receiver that follows four habits will never lose an event it could have kept.

// Express receiver: announce published posts in Slack
app.post("/releasepad", express.json(), async (req, res) => {
  const event = req.get("X-ReleasePad-Event");
  res.sendStatus(200); // answer first

  if (event !== "post.published") return; // created, deleted, test: ignore

  const post = req.body.data;
  if (new Date(post.publish_at) > new Date()) return; // scheduled: wait for it

  await slack.chat.postMessage({
    channel: "#releases",
    text: `*${post.title}*\n${post.blurb}\nhttps://pro.releasepad.io/en/acme-app`
  });
});

Security

Every delivery goes over HTTPS; http endpoints cannot be registered. Deliveries are not signed and carry no authentication header, so the URL itself is the credential. Treat it like one.

Signed deliveries (an HMAC header with a per endpoint secret) are on the roadmap. The URL secret pattern above will keep working once they ship.

Webhooks FAQ