Webhooks

A webhook makes Bupple the start of your workflow: each time something you picked happens in your workspace, Bupple POSTs it to your URL. Zapier's Catch Hook, n8n's Webhook node, Make's Custom webhook, Clay's webhook source, HubSpot's When a webhook is received trigger — or your own server — all take it.

You add one in Settings › Webhooks: the URL, where its events come from (the whole workspace, one brand or one campaign) and which events it gets. Webhooks in Platform 101 walks through the screens, the test button and the delivery log. This page is what your tool receives.

What your URL receives

A POST with a JSON body:

{
  "id": "5f0e2a8c-3d41-4b9e-9a77-1c2d3e4f5a6b",
  "type": "videostudio.editor.job.finish.completed.v1",
  "created_at": "2026-11-10T09:30:00.000Z",
  "workspace_id": "…",
  "brand_id": "…",
  "campaign_id": null,
  "data": { "…": "the event's own fields, plus a copy of what it is about" }
}

• id is the event's id. It is the same on every retry and every resend, so your tool can skip an event it has already handled.
• type is the event's name — one of the names in the tables below.
• data keeps every field of the event and adds a copy of what it is about, read when the call was made: the file with a 7-day download link, the post with its caption, accounts and links, the automation run with its drafts and outputs, the brand's and campaign's names. data_complete: false means part of that copy could not be read in time; the call was sent anyway.

Each event in Settings › Webhooks has an Example of its exact body.

The headers:

Answer quickly, with a 2xx

Any 2xx answer means delivered. Anything else — a 3xx too, because redirects are not followed — is a failed try, and Bupple tries again by itself, waiting longer each time, for several hours. A webhook that keeps failing for a day is switched off, and the workspace's owners and admins are told. Answer first and do the slow work afterwards.

Check that a call came from Bupple

When you add a webhook, Bupple shows its signing secret once (whsec_…). The bupple-signature header is an HMAC-SHA256 of the timestamp, a dot and the raw body, keyed with that whole secret, in hex. To check it: read the raw body before any JSON parsing, rebuild the signature, compare, and refuse a timestamp that is too old.

import crypto from 'node:crypto'

/** True when `rawBody` was signed by Bupple with `secret` in the last five minutes. */
export function isFromBupple(rawBody, signatureHeader, secret, toleranceSeconds = 300) {
  const parts = (signatureHeader ?? '').split(',').map((p) => p.trim().split('='))
  const t = Number(parts.find(([k]) => k === 't')?.[1])
  const sent = parts.filter(([k]) => k === 'v1').map(([, v]) => v)
  if (!Number.isFinite(t) || Math.abs(Date.now() / 1000 - t) > toleranceSeconds) return false
  const expected = crypto.createHmac('sha256', secret).update(`${t}.${rawBody}`, 'utf8').digest('hex')
  return sent.some((v) => v.length === expected.length && crypto.timingSafeEqual(Buffer.from(v), Buffer.from(expected)))
}

In a tool without code, check it with the tool's own HMAC step: n8n's Crypto node (Hmac, SHA256, hex) or Make's sha256(text; hex; key) function, over <t>.<raw body>. Zapier needs Catch Raw Hook (the plain Catch Hook does not pass the headers) and a Code by Zapier step. If your tool cannot check it, keep the URL secret and treat it like a password.

Every event you can send

The catalogue grows when Bupple adds an event, and Send every event includes the new ones. The tables are the catalogue as of November 2026; Settings › Webhooks always lists the current one. Bupple's own internal events are never sent.

Automations

Superagent

Campaigns

Media Library

Posts

Inbox

Analytics

Brand

Imagine

Web Search, Link Reader and Social Reader

Video

Video Editor and Design Editor

Workspace and people

Credits and billing

Integrations

Schedules

Notifications

What to read next

• When a post goes live — a webhook into your CRM.
• Finished video to your tools — a webhook that saves the file where your team keeps it.