A guide to webhooks, and a documentation you can navigate

Two things: webhooks now have a page of their own, and the site has been reorganised around what you are actually trying to do.

Webhooks, explained end to end

The Webhooks page covers what the four events mean and when each one fires, the delivery envelope field by field, the authentication header your endpoint can require, the rules a destination URL has to satisfy, and the template variables and hooks_extra_data you can use to carry your own context into the call.

We never send personal data over a webhook unless you gave us a key to encrypt it with. Without an aes_key, the event carries no data at all: it tells you that something happened, and you fetch the records over the authenticated API. This was always the behaviour — it is now written down, because designing around the opposite assumption fails silently.

While the self-service screens are being built, webhook destinations are configured by our team: send support the URL for each event you want, and the header you would like us to send. The per-event hooks endpoints in the API reference are deprecated and no longer decide any delivery.

A clearer shape

The navigation now separates learning from looking things up:

Guides — the platform itself: getting started, payload encryption, and the data models reference.
Flows — one section per product, with a new page explaining what a flow is and how it differs from calling the API directly.
API Reference — endpoints and schemas only, nothing else mixed in. Every API URL is unchanged.
Changelog — this page, now one click from anywhere.

The API Reference now opens with Using the API, which gathers what holds true for every endpoint and had never been written down anywhere: the X-APP-SECRET header and where it must never go, the base URLs, the {"detail": "<code>"} error shape and why you should branch on the code rather than the message, and the headers every response carries — x-request-id (quote it to support and we find your exact call), x-process-time, and the x-ratelimit-* trio you should read your budget from instead of hardcoding limits.

Guide pages moved to /guides/… and /flows/…; every previous link redirects, so nothing you have bookmarked or linked to is broken.

Payload encryption, scoped honestly

The encryption guide said “Payload Encryption & Decryption” while documenting a single scheme. It now opens by naming the scheme it details — AES-256-GCM, for everything we send you — and closes with the RSA envelope used for values sent to us, whose full walkthrough ships with the Direct Executions reference.