0.x — pre-release, no compatibility promise yet.What this means
Create a webhook (the signing secret is shown once)
Register an HTTPS endpoint for a set of events. The response’s secret is the only time it is ever shown -
store it now. Deliveries are signed Standard-Webhooks style (webhook-id, webhook-timestamp,
webhook-signature). Events of private projects are included.
Authorizations
Section titled “Authorizations”Request Bodyrequired
Section titled “Request Bodyrequired”The request body of webhooks.create.
object
The organization
An https:// endpoint (http://localhost is accepted outside production)
Dotted event names (task.updated) or <resource>.* wildcards (task.*); GET /v1/webhooks/events lists the vocabulary. A status change is task.updated with status in data.before / data.after.
Example
{ "org_id": "string", "name": "Deploy notifier", "url": "https://hooks.example.com/taskadence", "events": [ "task.*", "project.created" ], "project_ids": [ "string" ]}Responses
Section titled “ Responses ”Successful Response
Returned by webhooks.create and webhooks.rotate_secret.
object
As registered (an admin’s own configuration)
whsec_ + 6 characters - the secret itself is never shown again
THE SIGNING SECRET - shown once, stored only encrypted. Verify webhook-signature with the base64-decoded part after whsec_.
Example
{ "api_version": "2026-09-25", "consecutive_failures": 0, "created_at": "2026-09-25T12:00:00Z", "created_by": "3f1c2a9e-0b7d-4c1e-9a55-2b8f0d6e4a10", "events": [ "task.*" ], "key_version": 1, "name": "Deploy notifier", "org_id": "O0020", "secret": "whsec_Ab3xQ9eLr0v2Zk5n8WcHt1YpUo4MiGs7Fj6Da0Bq0RU=", "secret_prefix": "whsec_Ab3xQ9", "status": "active", "subscription_id": "WH123456", "updated_at": "2026-09-25T12:00:00Z", "url": "https://hooks.example.com/taskadence"}Bad request - a query parameter outside what the operation accepts (invalid-parameter)
An RFC 9457 problem details object - the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:taskadence:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
On an mfa-required problem only: enrolled (does the person have an authenticator app set up), required_for (all or admins) and reason (org_policy: the organization’s requirement; step_up: this action needs a second step)
object
Example
{ "type": "about:blank", "title": "Bad request", "status": 400, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}Missing or invalid bearer token
An RFC 9457 problem details object - the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:taskadence:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
On an mfa-required problem only: enrolled (does the person have an authenticator app set up), required_for (all or admins) and reason (org_policy: the organization’s requirement; step_up: this action needs a second step)
object
Example
{ "type": "about:blank", "title": "Missing or invalid bearer token", "status": 401, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}Authenticated, but not allowed
An RFC 9457 problem details object - the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:taskadence:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
On an mfa-required problem only: enrolled (does the person have an authenticator app set up), required_for (all or admins) and reason (org_policy: the organization’s requirement; step_up: this action needs a second step)
object
Example
{ "type": "about:blank", "title": "Authenticated, but not allowed", "status": 403, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}Not found
An RFC 9457 problem details object - the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:taskadence:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
On an mfa-required problem only: enrolled (does the person have an authenticator app set up), required_for (all or admins) and reason (org_policy: the organization’s requirement; step_up: this action needs a second step)
object
Example
{ "type": "about:blank", "title": "Not found", "status": 404, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}Conflict (a duplicate, or an Idempotency-Key still in flight)
An RFC 9457 problem details object - the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:taskadence:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
On an mfa-required problem only: enrolled (does the person have an authenticator app set up), required_for (all or admins) and reason (org_policy: the organization’s requirement; step_up: this action needs a second step)
object
Example
{ "type": "about:blank", "title": "Conflict (a duplicate, or an `Idempotency-Key` still in flight)", "status": 409, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}If-Match does not match the current ETag
An RFC 9457 problem details object - the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:taskadence:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
On an mfa-required problem only: enrolled (does the person have an authenticator app set up), required_for (all or admins) and reason (org_policy: the organization’s requirement; step_up: this action needs a second step)
object
Example
{ "type": "about:blank", "title": "`If-Match` does not match the current `ETag`", "status": 412, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}The body or query did not validate (validation), or an Idempotency-Key was reused
An RFC 9457 problem details object - the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:taskadence:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
On an mfa-required problem only: enrolled (does the person have an authenticator app set up), required_for (all or admins) and reason (org_policy: the organization’s requirement; step_up: this action needs a second step)
object
Example
{ "type": "about:blank", "title": "The body or query did not validate (`validation`), or an `Idempotency-Key` was reused", "status": 422, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}An access token, or a signed-in user, or an address over its limit (rate-limit; see Retry-After)
An RFC 9457 problem details object - the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:taskadence:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
On an mfa-required problem only: enrolled (does the person have an authenticator app set up), required_for (all or admins) and reason (org_policy: the organization’s requirement; step_up: this action needs a second step)
object
Example
{ "type": "about:blank", "title": "An access token, or a signed-in user, or an address over its limit (`rate-limit`; see `Retry-After`)", "status": 429, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}Unexpected server error - quote request_id
An RFC 9457 problem details object - the body of every error response. detail is the human-readable explanation; request_id identifies the request for support.
object
about:blank or a urn:taskadence:problem:* identifier
Human-readable explanation (a string; for a 422, the list of validation errors)
Structured failures: validation errors, or {loc, msg, allowed} for a bad parameter
object
On an mfa-required problem only: enrolled (does the person have an authenticator app set up), required_for (all or admins) and reason (org_policy: the organization’s requirement; step_up: this action needs a second step)
object
Example
{ "type": "about:blank", "title": "Unexpected server error", "status": 500, "detail": "…", "instance": "/v1/…", "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"}