Cavuno
Sign InStart for free
All updates

Webhooks

Cavuno now pushes job, company, and candidate changes to your own systems the moment they happen. Eleven signed events, automatic retries, and a 30-day delivery log you can inspect and replay.

Abi Tyas TunggalAJack WalshJ
By Abi Tyas Tunggal and Jack Walsh on

Keeping another system in step with your board used to mean polling the API on a timer. Now Cavuno tells you when something changes.

How it works

  • Add an endpoint: go to Settings → Developer → Webhooks, enter an HTTPS URL, and pick the events it should receive. The signing secret is shown once when you create it
  • Eleven events: job, company, and candidate, each with created, updated, and deleted, plus marketing_permission.granted and marketing_permission.withdrawn. Publishing, pausing, and expiring a job all arrive as job.updated — read changed_fields to see what moved
  • Newsletter consent, end to end: add the consent checkbox to your sign-up forms or notification-preferences page in the website builder, and each decision arrives as a marketing_permission.* event — ready to wire straight into Customer.io, Resend, or whatever you send from. Withdrawals carry a reason, including the deleted-account signal your mailing list needs
  • Narrow payloads: every event carries a fixed set of fields plus a monotonic revision, so you can reject an older event that arrives after a newer one. Resumes, applications, and private profile data are never included
  • Send a test: the Send test action delivers one obviously synthetic event so you can check your receiver before real traffic arrives

Signed, retried, and inspectable

  • Standard Webhooks signatures: each delivery carries webhook-id, webhook-timestamp, and webhook-signature, signed with HMAC SHA-256, so an existing library for the spec will verify them
  • Retries with backoff: a failed delivery gets up to 10 attempts over 3 days, starting about 30 seconds apart and backing off to a 6 hour cap. Retry-After is honoured
  • Delivery log: the Deliveries panel shows every attempt with its status, latency, and diagnostic. Replay any delivery for 30 days — it reuses the original event ID and body
  • Endpoint health: three consecutive failures mark an endpoint Failing; ten, or a single 410, disable it. A successful delivery heals a failing endpoint on its own

Rotating secrets without downtime

Rotate secret issues a new signing secret and keeps the old one valid for 24 hours, signing each delivery with both. That gives you a day to deploy the new secret without dropping events.

Webhooks are included on every paid plan, starting with Starter. See the webhooks documentation for the event catalogue, payload shapes, and a Node verification sample.