Webhooks

CastConductor can send webhooks to notify external systems of events.

Overview

Webhooks allow you to receive real-time notifications when events occur in CastConductor, such as:

• Content published/updated
• License activated/deactivated
• App generated

Configuration

Configure webhooks in CastConductor → Settings → Webhooks.

Webhook URL

Enter the URL where you want to receive webhook events.

Secret Key

A shared secret for verifying webhook authenticity.

Events

Select which events should trigger webhooks.

Webhook Payload

All webhooks are sent as POST requests with a JSON body:

{
  "event": "content.published",
  "timestamp": "2025-12-14T12:00:00Z",
  "data": {
    "id": 123,
    "type": "content_block",
    "title": "New Video"
  }
}

Verifying Webhooks

Each webhook includes a signature header:

X-CastConductor-Signature: sha256=abc123...

Verify by computing HMAC-SHA256 of the request body using your secret key.

PHP Example

$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_CASTCONDUCTOR_SIGNATURE'];
$expected = 'sha256=' . hash_hmac('sha256', $payload, $secret);

if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit('Invalid signature');
}

Events

Retry Policy

Failed webhooks are retried:

• 3 attempts
• Exponential backoff (1min, 5min, 30min)
• After 3 failures, webhook is disabled

Best Practices

1. Respond quickly — Return 200 within 5 seconds
2. Process async — Queue heavy processing
3. Verify signatures — Always validate authenticity
4. Handle duplicates — Events may be sent multiple times