Webhooks

Webhooks send what happens in WORK³ to an address of your own, for example a webhook in n8n, Make or Zapier, as it happens.

Add an address

1. Go to Settings → Integrations → Webhooks and click Add address. You need the Connect integrations and rules permission.
2. Paste the address. It must be a public https:// address; addresses inside a private network are refused.
3. Choose the events to send: item created, changed or deleted, item due tomorrow (sent at 08:00 the day before, in the workspace’s time zone), new comment, and project created, changed or deleted.
4. Click save and copy the signing secret now. It is shown only once.

Turn an address off with its switch. Its menu lets you Send test, edit it, Rotate secret or delete it.

What is sent

Each event is a POST with JSON: the event type, the workspace, who did it (actorId and actorName), and the item or project in the same shape as the REST API. A change also lists what changed, from and to; for status, type, priority, assignee and parent it gives the names too (a parent’s reference) (fromName, toName), and the item itself carries the names next to the ids. Changing an item’s tags is an item.updated with changes.labels (tag names before and after). Archiving or restoring an item is an item.updated with changes.archived, sent for each sub-item too. A project.updated lists only the fields whose value really changed, with the new value, and is not sent when nothing changed; previous holds the values they had, and a new lead comes with names (lead) on both sides. Both events also carry diff: the same changes per field under plain names, each as from and into, with { id, name } for values that have an ID.

Check the signature

Each request has the header WORK3-Signature: t=<time>,v1=<hmac>. Compute HMAC-SHA256 of <t>.<body> with the secret and compare it with v1. Reject requests where t is more than 5 minutes old. The header WORK3-Delivery is unique per delivery, so you can skip duplicates.

Example: n8n

The WORK³ app for n8n registers its webhook and checks the signature for you. Without it, you can do the same by hand:

1. Add a Webhook node with HTTP Method POST. Add its URL as an address in WORK³ (the Production URL, and activate the workflow) and copy the secret.
2. Add a Crypto node: Action Hmac, Type SHA256, Encoding HEX, Property Name expected, a Crypto credential with the secret as Hmac Secret, and as Value the expression:

   {{ $json.headers['work3-signature'].split(',')[0].slice(2) }}.{{ JSON.stringify($json.body) }}

3. Add an If node with two conditions joined by AND:
   • String is equal to: {{ $json.expected }} and {{ $json.headers['work3-signature'].split('v1=')[1] }}
   • Number is less than: {{ Math.abs(Date.now()/1000 - Number($json.headers['work3-signature'].split(',')[0].slice(2))) }} and 300
4. Continue from true with $json.body. Connect false to a Stop and Error node.

Use Send test on the address to try it. n8n’s Code node cannot load crypto by default, which is why the Crypto node is used.

Deliveries and retries

If the address does not answer with 2xx within 10 seconds, WORK³ tries again after 1 min, 5 min, 30 min, 2 h and 6 h. Recent deliveries shows each one and how it went, and Send again resends a failed one. Deliveries are kept for 30 days.

If your flow calls the REST API, which then sends a webhook back to the same flow, check who did it and skip events made by your own API key.