Outbound Webhooks

Outbound Webhooks

Outbound webhooks allow CrownSync Playbooks to push event notifications to any HTTP endpoint when specific actions occur on the platform. This enables you to integrate with tools and services that are not covered by the native integrations, build custom automations, and keep external systems in sync with your incident data.

Creating Webhook Endpoints

To create a new outbound webhook:

1. Navigate to Admin → Integrations
2. Select the Webhooks tab
3. Click Add Webhook
4. Enter the destination URL (must be HTTPS)
5. Select which events should trigger the webhook
6. Optionally add a description for the webhook
7. Click Save

CrownSync generates a webhook signing secret when the endpoint is created. Store this secret securely — you will need it to verify that incoming webhook payloads genuinely originate from CrownSync Playbooks.

Available Events

You can subscribe to the following events:

• incident.created— Fired when a new incident is declared
• incident.updated— Fired when incident details (severity, status, description) are modified
• incident.closed— Fired when an incident is closed
• incident.action_logged— Fired when an action is added to an incident timeline
• incident.evidence_attached— Fired when evidence is attached to an incident
• drill.started— Fired when a tabletop exercise begins
• drill.completed— Fired when a drill is completed
• playbook.exported— Fired when a playbook PDF is generated

Payload Format

Webhook payloads are sent as JSON via HTTP POST. Every payload includes the following fields:

• event — The event type (e.g. incident.created)
• timestamp— ISO 8601 timestamp of when the event occurred
• organisationId— Your organisation's unique identifier
• data— The event-specific payload containing the relevant resource details

The data field contents vary by event type. For incident events, it includes the incident ID, title, severity, status, and other relevant fields. Full payload schemas are documented in the API Reference.

Retry Policy

If your endpoint does not respond with a 2xx status code within 10 seconds, CrownSync retries the delivery using an exponential back-off schedule:

• First retry: 1 minute after the initial attempt
• Second retry: 5 minutes
• Third retry: 30 minutes
• Fourth retry: 2 hours
• Fifth retry: 12 hours

After five failed attempts, the delivery is marked as failed. You can view failed deliveries and manually retry them from the webhook management page.

Webhook Verification

Every webhook request includes an X-CrownSync-Signature header containing an HMAC-SHA256 signature of the request body, computed using your webhook signing secret. Verify this signature on your server to confirm the payload was sent by CrownSync and has not been tampered with. See the API Reference for verification implementation details.