Webhooks

A webhook tells your systems about changes on your job board as they happen. Cavuno sends a signed HTTPS request to a URL you choose whenever a job, company, or candidate is created, updated, or deleted. You do not have to poll the API to find out what changed.

Webhooks are included on every paid plan, starting with Starter. They are not available on the Free plan.

What you can listen for

You choose which events an endpoint receives. Selecting an event family also requires that family's read permission on your account.

See Events for what each one means and what it contains.

Add a webhook

1. Open Settings → Developer → Webhooks.
2. Select Add webhook.
3. Enter your Endpoint URL. It must be an HTTPS address that Cavuno can reach from the public internet.
4. Choose the Events this endpoint should receive. You can search the list and pick individual events rather than a whole family.
5. Select Add webhook to save.

Cavuno then shows your signing secret once. Copy it before closing the dialog — only an encrypted form is stored, and it is never shown again. If you lose it, rotate the secret to get a new one.

A new endpoint is enabled straight away and starts receiving the events you selected. It never receives events that happened before you created it.

Send a test

Use Send test on an endpoint to check that your receiver works. Cavuno sends one signed delivery containing obviously synthetic data and shows the response status and latency.

Test deliveries do not appear in the delivery log, and they never contain real candidate data. A failed test is diagnostic only and does not affect the endpoint's status.

What Cavuno does not send

Webhook payloads carry a narrow snapshot, not a full record. They never include resumes, applications, messages, private profile fields, employer-private data, or billing information. Candidate payloads carry only an ID, email address, display name, timestamps, and a revision number.

If you need more than the snapshot provides, read the resource from the API using the ID in the payload.

Managing endpoints with the API

Everything above can also be done programmatically. Endpoints and deliveries are Operator API resources, and the operations are listed in the API reference under /webhook-endpoints and /webhook-deliveries.

Reading endpoints and deliveries requires the webhooks.read scope. Creating, editing, testing, rotating, and replaying require webhooks.manage. Existing API keys do not gain these scopes automatically.

Requests from a board on the Free plan return 402 plan_upgrade_required. If a board moves back to Free, its endpoints stay saved but stop receiving events; delivery resumes on the next paid plan with no reconfiguration.