Outbound webhooks let Atoll notify external systems when work changes.
Use cases
- Notify a deployment system when an issue is marked done.
- Send task changes into a data warehouse.
- Trigger internal automation on assignment or priority changes.
- Mirror updates into Slack, Discord, or another project system.
Create a webhook
Or use the API:
The create response includes a secret. Store it immediately; it is shown only once. Later list responses show only an origin-level destination_display, never URL paths, query credentials, or signing material.
Atoll signs deliveries in the X-Atoll-Signature header as sha256=<hmac>, where the HMAC-SHA256 key is the SHA-256 hex digest of that secret and the message is the exact raw request body. X-Atoll-Signature-Version and X-Atoll-Signatures support bounded signing-key overlap. Each delivery also includes X-Atoll-Delivery-Id for receiver-side deduplication.
Payload schema version 2 contains allowlisted identifiers and operational fields. It omits descriptions, comment bodies, raw before/after values, and unrelated source data.
Inspect deliveries
Delivery history keeps safe outcome metadata, retry status, stable error_code, and next retry time. It does not return payloads, receiver response bodies, or raw errors. Atoll retries network failures and 5xx responses after 5s and 30s immediately; longer retries are recorded as retry_pending and handled automatically by Atoll’s background recovery process.
Redeliver
Use redelivery after the receiving endpoint has been fixed.
Test
The test route sends a ping event to confirm the receiver is reachable.
Webhook URLs must use HTTPS DNS hostnames. IP literals, localhost, and .local hosts are rejected, private or otherwise non-public DNS results are blocked at delivery time, and redirects are not followed.
