API & MCP reference / REST API

Webhooks

Set one URL per workspace under Dashboard → API Keys. Every time a post finishes we POST the per-platform results, signed with your workspace secret.

Delivery

POST {your_url}
X-Signature: hex(hmac_sha256(workspace_secret, raw_request_body))

{
  "event": "post.completed",
  "post_id": "uuid",
  "results": [
    { "platform": "tiktok",  "success": true,  "share_url": "…" },
    { "platform": "youtube", "success": false, "error": "…" }
  ]
}

Verify the signature against the raw request body before parsing it. Re-serializing the JSON first changes the bytes and the HMAC will never match.