Webhook events

Consume entry lifecycle events without assuming unsupported event families.

External delegated agents manage subscriptions through the versioned webhook.create, webhook.update, and webhook.delete Operation Definitions. The governance console has no webhook editor. Payloads contain identifiers and lifecycle data, not a content snapshot.

Events

Event	Trigger	`data` fields
`entry.published`	Entry becomes Published	Backend ID, type key, entity ID, status, version
`entry.unpublished`	Entry becomes Archived	Backend ID, type key, entity ID, status, version
`entry.changed`	Published entry gains working changes	Backend ID, type key, entity ID, status, version
`entry.deleted`	Entry is deleted	Backend ID, type key, entity ID
`release.published`	A Release publishes	Backend ID, Release ID/name, and the item manifest
`release.failed`	Release publication fails	Backend ID, Release ID/name, and failure details

{
  "type": "entry.published",
  "timestamp": "2026-07-15T12:00:00.000Z",
  "data": {
    "backendId": "BACKEND_ID",
    "typeKey": "article",
    "entityId": "ENTRY_ID",
    "status": "Published",
    "version": 7
  }
}

Each POST includes webhook-id, webhook-timestamp, webhook-signature, and content-type: application/json.

Route on type, verify the signature over the raw body, and deduplicate by webhook-id. If more data is needed, fetch by the identifiers only when a current public state exists; deletion and unpublication may make delivery lookup unavailable.

Access

Proposing/executing a webhook change requires operation.execute plus the definition’s permission with matching Backend and Environment scope:

webhook.create creates a subscription;
webhook.update changes events or active state;
webhook.read is the subscription/log read permission, but the current four-tool surface has no dedicated inspection kind for these lists;
webhook.delete removes a subscription.

The receiver authenticates the request with its signing secret and needs no CMS permission.

The six events above are the accepted subscription vocabulary. Separate Asset, model, and schedule event families are not available. Inspect the live Operation Definition before constructing a request; deletion is approval-aware.

Webhook queue or delivery failure does not roll back the content mutation.

Webhook events

Events

Access

Related