> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://infonite.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://infonite.dev/_mcp/server.

# A guide to webhooks, and a documentation you can navigate

Two things: webhooks now have a page of their own, and the site has been reorganised around what you are actually trying to do.

### Webhooks, explained end to end

The [**Webhooks**](/flows/spain-public-administration/webhooks) page covers what the four events mean and when each one fires, the delivery envelope field by field, the authentication header your endpoint can require, the rules a destination URL has to satisfy, and the template variables and `hooks_extra_data` you can use to carry your own context into the call.

> **Warning**
>
> **We never send personal data over a webhook unless you gave us a key to encrypt it with.** Without an `aes_key`, the event carries no `data` at all: it tells you *that* something happened, and you fetch the records over the authenticated API. This was always the behaviour — it is now written down, because designing around the opposite assumption fails silently.

While the self-service screens are being built, webhook destinations are configured by our team: send [support](mailto:support@infonite.tech) the URL for each event you want, and the header you would like us to send. The per-event `hooks` endpoints in the API reference are **deprecated** and no longer decide any delivery.

### A clearer shape

The navigation now separates **learning** from **looking things up**:

* [**Guides**](/guides/welcome) — the platform itself: getting started, payload encryption, and the data models reference.
* [**Flows**](/guides/what-is-a-flow) — one section per product, with a new page explaining [what a flow is](/guides/what-is-a-flow) and how it differs from calling the API directly.
* [**API Reference**](/guides/using-the-api) — endpoints and schemas only, nothing else mixed in. **Every API URL is unchanged.**
* **Changelog** — this page, now one click from anywhere.

The API Reference now opens with [**Using the API**](/guides/using-the-api), which gathers what holds true for every endpoint and had never been written down anywhere: the `X-APP-SECRET` header and where it must never go, the base URLs, the `{"detail": "<code>"}` error shape and why you should branch on the code rather than the message, and the headers every response carries — `x-request-id` (quote it to support and we find your exact call), `x-process-time`, and the `x-ratelimit-*` trio you should read your budget from instead of hardcoding limits.

Guide pages moved to `/guides/…` and `/flows/…`; every previous link redirects, so nothing you have bookmarked or linked to is broken.

### Payload encryption, scoped honestly

The [encryption guide](/guides/payload-encryption) said "Payload Encryption & Decryption" while documenting a single scheme. It now opens by naming the scheme it details — AES-256-GCM, for everything we send you — and closes with the RSA envelope used for values sent *to* us, whose full walkthrough ships with the Direct Executions reference.