Webhooks

rewish can POST signed JSON to your HTTPS endpoints when projects and issues change. Configure endpoints under Integrations → API & Webhooks in the workspace dashboard.

Authentication

Webhook requests are unsigned at the transport layer — verify each payload with the signing secret shown when you create an endpoint.

Header	Value
`Content-Type`	`application/json`
`X-rewish-Signature`	`sha256=<hex>` HMAC of the raw body
`User-Agent`	`rewish-webhooks/1.0`

Verify signatures (Node.js)

import { createHmac, timingSafeEqual } from "node:crypto";

function verifyRewiSignature(secret: string, rawBody: string, header: string | null) {
	if (!header?.startsWith("sha256=")) {
		return false;
	}
	const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
	const received = header.slice("sha256=".length);
	if (expected.length !== received.length) {
		return false;
	}
	return timingSafeEqual(Buffer.from(expected), Buffer.from(received));
}

Payload shape

Every delivery uses the same envelope:

{
	"event": "issue.created",
	"timestamp": "2026-09-01T12:00:00.000Z",
	"data": {
		"organizationId": "org_…",
		"issue": {}
	}
}

For project events, data.project is set instead of data.issue:

{
	"event": "project.created",
	"timestamp": "2026-09-01T12:00:00.000Z",
	"data": {
		"organizationId": "org_…",
		"project": {
			"id": "…",
			"name": "Marketing site",
			"slug": "marketing-site"
		}
	}
}

Issue object

Field	Type	Description
`id`	string	Issue id
`number`	number	Issue number in the project
`title`	string	Issue title
`status`	string	Board status
`priority`	string	Priority / severity
`url`	string \| null	Page URL when reported from a website
`projectId`	string	Parent project id
`projectName`	string	Parent project name

Events

Event	BugHerd equivalent	When it fires
`project.created`	`project_create`	A new project is created in the workspace
`issue.created`	`task_create`	A new issue is created
`issue.updated`	`task_update`	Non-status issue fields change
`issue.deleted`	`task_destroy`	An issue is deleted
`issue.comment.created`	`comment`	A comment is added
`issue.status_changed`	(part of `task_update`)	Issue status / board column changes

Status-only updates send issue.status_changed only (not issue.updated).

Each endpoint can listen to all projects or a single project. Scoped endpoints only receive events for that project. project.created fires for the new project when the endpoint is scoped to all projects or to that project.

REST API

Use a workspace API key (ntk_live_…) from Integrations → API & Webhooks with the REST API (/api/v1/projects, /api/v1/issues, and webhook delivery routes).

Webhooks complement the API: use webhooks for push notifications and the API to read or mutate resources on demand.