Help › Keys, CLI and automation
Webhooks and the audit log
Webhooks#
A webhook is a message we send to an address on your server when something happens.
| Event | When |
|---|---|
site.published | A publish finished (data: version and languages) |
job.failed | A scan, translate or publish job ended in failure |
quota.reached | A usage limit was reached |
key.rotated | A secret API key was rotated. The key itself is never sent. |
webhook.ping | You pressed "send test event" |
There are more events for editing, review, invitations and Shopify. See Webhook events reference.
Each message is JSON. It carries an event id that stays the same on retries, so you can ignore duplicates. Delivery is at least once and not in order. Reply with any 2xx status within 10 seconds, and do the real work afterwards.
Check the signature#
Every message has an RL-Signature header made with your signing secret. Verify it on the raw bytes of the body, compare in constant time, and reject messages older than 5 minutes. Example code for Node, Python and PHP is in the repository's webhook guide.
Retries#
A failed delivery is retried up to 8 times in total, with longer gaps each time (about 30 seconds, 2 minutes, 10 minutes, 30 minutes, 2 hours, 6 hours, 12 hours). After that it is marked abandoned. A 410 Gone answer switches the endpoint off at once. 30 failures in a row also switch it off. You can send a test, look at the delivery log for 30 days, and replay a delivery.
Rules for the address#
The address must be secure (HTTPS), on the standard port, and must resolve to a public address. Private, local and single-name addresses are refused. Redirects are not followed.
Secrets#
The signing secret is shown once. You can rotate it with a grace period of up to 72 hours.
Audit log#
The audit log records who did what: sign-ins, key changes, edits, publishes, webhook changes and support sessions. Owners and admins can read it. Entries are chained so that a changed or missing entry can be detected. The last digit of an IPv4 address is cleared.
The default retention is 365 days, and you can choose between 30 and 730. The owner approved these numbers on 2026-10-28 (decision D49). Pages for webhooks and the audit log are not built in the dashboard yet. Today they are API functions: OPEN.