Webhooks

API credentials let your system ask Knowspread questions. Webhooks are the other direction: the space tells your system when something happens, without being asked.

What webhooks are good for

Without a webhook your system has to keep asking: call the API every few minutes and check whether anything changed. It is like walking to the door every so often to see if someone has arrived. A webhook is the doorbell. The space calls you, and only when something has actually happened.

The four events on offer cover the everyday situations companies otherwise handle by hand:

• Training shows up where people already work. An employee is assigned a mandatory course. content_assignment_created arrives and your intranet or calendar creates a task with the deadline. Nobody has to open Knowspread to find out what they have to do.
• HR ticks the requirement off by itself. A new colleague finishes safety training. content_assignment_completed arrives and the HR system marks the requirement fulfilled. The Friday spreadsheet export and the retyping go away.
• A manager hears about a missed deadline the same day. Someone does not finish assigned content in time. content_assignment_overdue arrives and your system messages their manager in Teams or Slack. Without the webhook, someone would look for it in the completion overview whenever they remembered to.
• A test result lands in the register. Someone finishes a test. test_attempt_completed arrives and your qualification register or audit trail gets the record the moment it happens, not at the next review.

A webhook says that something happened. When your system needs the details, it asks for them through the API with API credentials. The two complement each other: the event is the trigger, the API is the source of detail.

The screen

123

Webhook settings with the event catalogue open

• (1) One endpoint receives everything. You give its URL and a secret — Vygenerovat secret produces one for you.
• (2) Auth type is separate from the secret and defaults to none. Basic auth credentials appear once you pick it.
• (3) Subscriptions are added one event at a time, each with a schema version. Nothing is subscribed by default.

The events on offer

The picker offers four events, and they are about assignments and tests rather than about people or content changing.

Event	Fires when
content_assignment_created	Content is assigned to someone
content_assignment_completed	Someone finishes assigned content
content_assignment_overdue	An assignment passes its deadline
test_attempt_completed	Someone finishes a test attempt

Each subscription carries a schema version — v1.0 is what the version picker offers — so the payload shape is versioned separately from the event name.

The secret is a signature, not a password

Basic auth is separate and optional — it authenticates the call at the transport level, where the secret authenticates the payload.

What to watch for

In a personal space this screen draws the form but nothing behind it is live: webhooks, webhook_settings and webhooks/pending_requests all answer 403. The subscription section stays empty because it was refused, not because nothing is subscribed.