Skip to content
Postivate

Webhooks

Social media webhooks: know the moment a post goes live.

Postivate tells your systems when a post is scheduled, published or fails, when an approval is requested or given, and when a channel needs attention. Every request is signed, retried for about two days and kept in a log you can replay.

Start your 7-day free trialSee every event
  • On every plan
  • Standard Webhooks signatures
  • Retried for about two days

CRM sync

https://hooks.acme.dev/postivate

Active

Postivate

channel.action_required

Alder & Co. · LinkedIn

Your endpoint

503 · retry in 1 min

webhook-signature: v1,…

Deliveries

  • publication.published

    Delivered

    Published to a channel · Attempt 1

  • approval.requested

    Delivered

    Approval requested · Attempt 1

  • channel.action_required

    Pending

    Channel needs attention · Attempt 1 · next try in 1 min

Events
12
posts, publications, approvals, channels
Retries
8
over about two days
Timeout
10 s
any 2xx counts as delivered
Delivery log
30 days
send any delivery again

12 events

Hear about what matters, as it happens.

Each endpoint subscribes to the events it needs. Every payload names the workspace it came from.

Posts

  • post.createdDraft created

    A draft is created, from text or a template.

    data.post: id, title, status, createdVia, destinationConnectionIds

  • post.scheduledPost scheduled

    A post becomes scheduled.

    data.post: id, title, status, previousStatus

  • post.publishedPost published everywhere

    Every channel of the post has published.

    data.post: id, title, status, previousStatus

  • post.failedPost failed

    The post failed on every channel.

    data.post: id, title, status, previousStatus

Publications

  • publication.publishedPublished to a channel

    One channel published, with the live URL.

    data.publication: id, postId, channelConnectionId, channelType, format, url, publishedAt

  • publication.failedFailed on a channel

    One channel failed for good, after its retries.

    data.publication: id, postId, channelConnectionId, channelType, format, errorCode, message

Approvals

  • approval.requestedApproval requested

    A revision is sent for review.

    data.approval: postId, revisionNumber, requestedBy, scheduledAt, note

  • approval.approvedApproved

    An approver signs off the revision.

    data.approval: id, postId, revisionNumber, approvedBy, comment

  • approval.changes_requestedChanges requested

    An approver sends it back.

    data.approval: id, postId, requestedBy, comment

Channels

  • channel.connectedChannel connected

    An account is connected or reconnected.

    data.channel: id, channelType, name, reconnected

  • channel.action_requiredChannel needs attention

    An account stops being able to publish, for example an expired login.

    data.channel: id, channelType, name, status, reason

  • channel.disconnectedChannel disconnected

    An account is disconnected; its pending posts are cancelled.

    data.channel: id, channelType, name, cancelledPublications

Signed, the standard way

Check every request in a few lines.

Deliveries follow the Standard Webhooks spec, so any of its libraries can verify them. The signature is an HMAC-SHA256 of the delivery id, the timestamp and the exact body, keyed with the endpoint’s secret.

  • webhook-id, webhook-timestamp and webhook-signature on every request
  • Retries keep the same webhook-id: deduplicate on it
  • Reject old timestamps to stop replayed requests
  • Reveal the secret again or rotate it; rotating takes effect immediately
POST /hooks/postivate HTTP/1.1
content-type: application/json
user-agent: Postivate-Webhooks/1.0
webhook-id: 0199b3c4-7f2e-7a51-9c1d-5e8a2b0f4d63
webhook-timestamp: 1791820803
webhook-signature: v1,K5oZfzN95Z9UVu1EsfQmfVNQhnkZ2pj9o9NDN/H/pI4=

{
  "id": "0199b3c4-7f1a-7c02-8e4b-1d2f3a4b5c6d",
  "type": "publication.published",
  "timestamp": "2026-10-08T07:00:03.000Z",
  "organizationId": "0198f0a2-…",
  "workspace": { "id": "0198f0a2-…", "name": "Northwind Café" },
  "data": {
    "publication": {
      "id": "0199b3c4-…",
      "postId": "0199b2e1-…",
      "channelConnectionId": "0198f0c7-…",
      "channelType": "instagram",
      "format": "REEL",
      "url": "https://www.instagram.com/reel/…",
      "publishedAt": "2026-10-08T07:00:02.000Z"
    }
  }
}

Delivery log

See every delivery, and send any of them again.

Each endpoint has a log of what was sent, what your endpoint answered and every attempt. Fixed a bug? Send a failed delivery again with one click, under the same webhook-id.

  • Status, response and attempts for 30 days
  • The exact payload that was sent, for each delivery
  • Send a test event to check a new endpoint
  • Sending again starts a fresh round of retries

Deliveries

https://hooks.acme.dev/postivate

Send test event

  • publication.failed

    Delivered

    Attempt 1 · 200 · 131 ms

    just now
    { "type": "publication.failed",
  "data": { "publication": { "channelType": "x",
    "errorCode": "MEDIA_REJECTED", … } } }
    webhook-id: 0199b3c4-7f2e…Send again

  • approval.approved

    Delivered

    Attempt 1 · 200 · 87 ms

    2 h ago

  • post.scheduled

    Delivered

    Attempt 2 · 200 · 120 ms

    yesterday

  • webhook.test

    Delivered

    Attempt 1 · 204 · 64 ms

    3 days ago

When your endpoint is down

9 attempts over about two days.

A delivery that doesn’t get a 2xx is tried again with growing waits, so a deploy or an outage on your side doesn’t lose events.

  1. 1

    Right away

  2. 2

    +1 min

  3. 3

    +5 min

  4. 4

    +30 min

  5. 5

    +2 h

  6. 6

    +5 h

  7. 7

    +10 h

  8. 8

    +14 h

  9. 9

    +20 h

If 10 events in a row fail for good, the endpoint is turned off and the organization gets a notification, so a dead URL doesn’t pile up deliveries. Turn it back on when it’s fixed.

Built to be safe

Rules every endpoint follows.

  • https only

    Endpoints must use https and can’t carry a username or password in the URL.

  • Public addresses only

    Private, loopback and cloud metadata addresses are refused, and the address is checked again on every delivery.

  • 10 seconds to answer

    Any 2xx within 10 seconds counts as delivered. Redirects aren’t followed, so use the final URL.

  • Small payloads

    Ids and the fields you act on, like the live URL. Fetch the full post through the REST API when you need it.

  • Your scope, your events

    All workspaces or only some, and only the events you pick. Up to 20 endpoints per organization.

  • Run by owners and admins

    Organization owners and admins add endpoints, reveal and rotate secrets, and every change is in the activity log.

The REST APIFetch the full post behind an event, or create and schedule posts from your own code.

Webhooks FAQ

Postivate webhooks, answered.

Which events can Postivate send?

12 events: post.created, post.scheduled, post.published, post.failed, publication.published, publication.failed, approval.requested, approval.approved, approval.changes_requested, channel.connected, channel.action_required, channel.disconnected. Pick the ones each endpoint should receive.

How are webhooks signed?

With the Standard Webhooks scheme. Every request carries webhook-id, webhook-timestamp and webhook-signature, an HMAC-SHA256 of the id, the timestamp and the body, keyed with the endpoint’s whsec_ secret. Any Standard Webhooks library can verify it.

What happens if my endpoint is down?

Postivate retries 8 times with growing waits (1 min, 5 min, 30 min, 2 h, 5 h, 10 h, 14 h, 20 h), about two days in all. If 10 events in a row fail for good, the endpoint is turned off and the organization is notified. Turn it back on when it’s fixed.

How do I handle duplicates?

Deduplicate on the webhook-id header. Retries and deliveries you send again keep the same webhook-id, so a receiver that stores the ids it has handled processes each event once.

What does my endpoint need to answer?

Any 2xx status within 10 seconds. Redirects aren’t followed, so point the endpoint at its final URL. The URL must use https and be reachable on the public internet.

Why does the payload carry only ids and a few fields?

So it stays small and never goes stale. It has what you need to act, like the post id, the channel and the live URL. Fetch the full post through the REST API when you need more.

Can I replay a delivery or send a test?

Yes. Each endpoint has a delivery log with the status, the response and every attempt, kept for 30 days. Send any delivery again with one click, or send a test event to check your endpoint.

Which plans include webhooks?

Every plan, including the free trial. An organization can have up to 20 endpoints, each for all of its workspaces or only some. Organization owners and admins set them up.

Your next week of content, planned by Friday.

Connect your channels, invite your team and publish your first post today. 7 days free, no credit card.

Start your free trialSee pricing