Integrate

Webhooks

Subscribe to task and compliance changes with encrypted signing secrets, durable delivery records, and automatic retries.

Events

task.created
task.updated
task.comment.created
tax_product.draft_detected
tax_product.revision_published
tax_product.mapping_validated
tax_product.mapping_blocked
tax_product.revision_activated
organization.document_refresh_recommended

Verify a delivery

Compute HMAC-SHA256 over webhook-id.webhook-timestamp.raw-body with the signing secret, then compare it to the base64 digest in webhook-signature.

webhook-id: event_123
webhook-timestamp: 1787437902
webhook-signature: v1,base64_digest

Endpoint requirements

Endpoints must use public HTTPS. Redirects, private networks, loopback addresses, link-local addresses, and reserved DNS targets are rejected.