Receive outgoing DocuWriter webhooks
Outgoing webhooks notify your service when selected DocuWriter events occur. Use them for completion notifications, integration workflows, or a downstream index. They are separate from the Git-provider webhooks used by Autopilot.
Create a subscription
Configure a subscription in DocuWriter’s integration settings or through POST /api/webhooks, using a publicly reachable HTTPS URL and selected event names. Authenticate API requests as described in the API quickstart.
{
"webhook_url": "https://example.com/hooks/docuwriter",
"events": ["generation.created"]
}
Supported events include:
| Event | Use |
|---|---|
generation.created |
React to a new generation. |
generation.updated |
React to an updated generation. |
repository_sync.suggestions_ready |
Notify reviewers about Autopilot suggestions. |
repository_sync.suggestion_applied |
Track an applied suggestion. |
repository_sync.suggestion_discarded |
Track a discarded suggestion. |
Use GET /api/webhooks/events/available for the available event catalog.
Verify requests before processing
The POST body contains event, timestamp, webhook_id, and an event-specific data object. Requests include X-DocuWriter-Event and X-DocuWriter-Signature headers. The signature is sha256= followed by the hexadecimal HMAC-SHA256 of the exact JSON request body, using your subscription secret.
Read the raw request body before JSON parsing. Compute the HMAC over those exact bytes and compare it with the supplied signature using a constant-time comparison. Re-encoding parsed JSON can change whitespace or escaping and invalidate the comparison. Store the subscription secret securely.
webhook_id identifies the subscription, not a unique occurrence of an event. Design duplicate handling using the event and relevant resource/version information in its payload. Do not assume all event types share the same data fields.
Acknowledge and monitor
Validate the request, enqueue your downstream work, and return a successful HTTP response promptly. Delivery requests have a 30-second timeout. Do not depend on automatic retries: the current dispatcher is configured for one job attempt. Inspect delivery logs and subscription status when an event does not arrive; repeatedly failing subscriptions can be disabled.
For an unreachable receiver, check HTTPS, public address reachability, and the exact configured URL. Redirects are not followed. For signature failures, compare raw-body handling and the subscription secret. For a successful delivery with no downstream result, inspect your receiver or n8n execution history.
Pause or remove a subscription when retiring its receiver. See n8n setup for an automation-based consumer.
Updated