==============================================================================

Source: https://docs.snapenv.io/guide/webhooks

==============================================================================

Webhooks

Fire HTTP POST requests to any URL when variables change. Use them to trigger deployments, notify Slack, or invalidate caches.

Create a webhook

Workspace → Settings → Webhooks → Add webhook.

• URL — the endpoint to POST to
• Events — which events trigger this webhook
• Secret — auto-generated whsec_… signing secret (shown once)

Events

Event	When
var.update	Single variable updated
var.delete	Single variable deleted
var.restore	Variable restored from history
vars.bulk_upsert	Bulk save (dashboard or snapenv push)
vars.bulk_delete	Bulk delete
vars.pull	Variables pulled via CLI or operator

Payload

{
  "event": "vars.bulk_upsert",
  "projectId": "uuid",
  "env": "production",
  "actor": "Dana Whitfield",
  "keys": ["DATABASE_URL", "REDIS_URL"],
  "created": ["REDIS_URL"],
  "updated": ["DATABASE_URL"],
  "timestamp": "2026-06-01T10:00:00Z"
}

Verifying signatures

Every delivery includes an X-SnapEnv-Signature header:

X-SnapEnv-Signature: sha256=<hmac-hex>

Verify on receipt using HMAC-SHA256(signingSecret, rawRequestBody):

import hmac, hashlib

def verify(secret: str, body: bytes, header: str) -> bool:
    expected = "sha256=" + hmac.new(
        secret.encode(), body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, header)

import { createHmac, timingSafeEqual } from 'crypto';

function verify(secret: string, body: string, header: string): boolean {
  const expected = 'sha256=' + createHmac('sha256', secret).update(body).digest('hex');
  return timingSafeEqual(Buffer.from(expected), Buffer.from(header));
}

Delivery log

The dashboard shows the last delivery status (HTTP status code) and timestamp for each webhook. Deliveries are async with a 10-second timeout.

==============================================================================

Source: https://docs.snapenv.io/api/webhooks

==============================================================================

Webhooks API

See Webhooks guide for the payload format and signature verification.

GET /v1/workspace/webhooks

{
  "webhooks": [
    {
      "id": "uuid", "name": "Deploy trigger",
      "url": "https://hooks.example.com/deploy",
      "events": ["vars.bulk_upsert", "var.update"],
      "active": true, "lastFiredAt": "...", "lastStatus": 200, "createdAt": "..."
    }
  ]
}

POST /v1/workspace/webhooks

Owner only.

// request
{ "name": "Deploy trigger", "url": "https://hooks.example.com/deploy", "events": ["vars.bulk_upsert"] }

// response 201
{
  "id": "uuid", "name": "Deploy trigger",
  "url": "https://hooks.example.com/deploy",
  "events": ["vars.bulk_upsert"],
  "active": true,
  "secret": "whsec_..."
}

secret is shown once — use it to verify incoming payloads.

PATCH /v1/workspace/webhooks/:id

Owner only. All fields optional.

{ "name": "New name", "url": "https://...", "events": [...], "active": false }

DELETE /v1/workspace/webhooks/:id

Owner only. Returns 204.