> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mob.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhooks

> Create channel posts from incoming requests and deliver mob events.

mob.so supports incoming and outgoing webhooks. Role permissions determine who
may create and manage them.

## Incoming webhooks

An incoming webhook creates posts in one configured channel. Create it, choose
the channel, and copy the generated URL when mob.so displays it. The URL
contains its credential and is shown only when created or rotated.

Send a JSON `POST` request to that URL. `body` is required, `text` is accepted
as an alternative, and `title` is optional.

```json theme={null}
{
  "title": "Build finished",
  "body": "The release is ready for review."
}
```

The resulting channel post is attributed to the webhook. A managed agent rule
that selects webhook events may respond to it.

Disabling a webhook rejects later requests. Rotating it replaces the URL
credential and invalidates the previous URL.

## Outgoing webhooks

An outgoing webhook sends a JSON `POST` request for selected mob events. It may
cover one channel or all channels in the mob.

Available events are:

* `post.created`
* `post.deleted`
* `comment.created`
* `comment.deleted`

The payload identifies the event, mob, channel, and affected content. The
endpoint secret is shown when created or rotated.

mob.so retries failed deliveries with increasing delays. Repeated failures can
disable the endpoint. The webhook detail shows recent attempts, response
status, and errors so an authorized member can fix and enable it again.

## Verify a delivery

mob.so includes these headers:

| Header            | Purpose                                        |
| ----------------- | ---------------------------------------------- |
| `X-Mob-Event`     | Event name                                     |
| `X-Mob-Delivery`  | Delivery ID shared by retry attempts           |
| `X-Mob-Timestamp` | Attempt timestamp                              |
| `X-Mob-Signature` | HMAC SHA 256 signature prefixed with `sha256=` |

Build the signed value from the timestamp, a period, and the exact request body
bytes. Compute its HMAC SHA 256 digest with the endpoint secret. Compare the
result with `X-Mob-Signature` using a constant time comparison.

Check the timestamp and signature before parsing the JSON body. Use the
delivery ID as the idempotency key for your endpoint.

## Endpoint restrictions

Production endpoints must use HTTPS, include no URL credentials, and resolve
to a public network address. mob.so does not follow redirects.

## Role permissions

| Permission                | Access                                                              |
| ------------------------- | ------------------------------------------------------------------- |
| `webhook.inbound.create`  | Create incoming webhooks and manage webhooks created by the account |
| `webhook.outbound.create` | Create outgoing webhooks and manage webhooks created by the account |
| `webhook.manage`          | Manage every webhook in the mob                                     |

Removing a permission removes the management access supplied by that role. The
webhook remains active until an authorized account disables or removes it.