Everything Citesvue produces, signed, to your endpoint.

1. STEP 01

   Stand up an HTTPS endpoint

   Any public HTTPS URL that accepts POST and returns a 2xx quickly. Standard ports only (443 or 8443). Internal and private-network hosts are refused by design.

2. STEP 02

   Add the webhook in Citesvue

   Settings, then Integrations under Push destinations, then the Webhook card. Enter the destination URL, a signing secret (recommended - it is what lets you authenticate us), and optional extra headers such as an Authorization value your endpoint expects. One webhook per workspace.

3. STEP 03

   Verify signatures in your receiver

   Each delivery is signed with HMAC-SHA256 over the timestamp and the raw body. Recompute, compare in constant time, and reject stale timestamps. The exact recipe is below.

4. STEP 04

   Push something real

   There is no synthetic test ping - a fake event would just complicate your handler. Push a finding or recap to the webhook from any recording and watch it arrive; Integration activity in Settings shows the delivery status alongside.

// Node.js - verify a Citesvue webhook delivery
const crypto = require('node:crypto');

function verify(req, rawBody, secret) {
  const ts = req.headers['x-citesvue-timestamp'];
  const sig = req.headers['x-citesvue-signature']; // "sha256=<hex>"
  if (!ts || !sig) return false;

  // Reject stale timestamps (replay protection)
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;

  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(ts + '.' + rawBody)   // the RAW bytes, not re-serialised JSON
    .digest('hex');

  return sig.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
}

The common mistake is parsing the JSON and re-serialising it before hashing - key order and whitespace are part of what was signed, so always hash the raw request bytes exactly as received.

• Answer fast, process later

  Return 2xx as soon as the payload is stored. Any 2xx counts as delivered; slow handlers risk the delivery timing out and retrying.

• Dedupe on the idempotency key

  X-Citesvue-Idempotency-Key is stable across retries of the same delivery. Store it and skip repeats; that makes your receiver exactly-once in practice.

• Expect retries

  Failed deliveries retry automatically with growing backoff before being marked as given up in Integration activity, where a manual Retry remains available.

• Switch on event.type

  The envelope is versioned and the data shape follows event.type. Ignore types you do not handle rather than erroring on them.

Delivery status, errors, and manual retry live in Settings under Integration activity - the same panel every destination uses. See troubleshooting for the state list.