Webhooks

Events

task.created
task.updated
task.comment.created
tax_product.draft_detected
tax_product.revision_published
tax_product.mapping_validated
tax_product.mapping_blocked
tax_product.revision_activated
organization.document_refresh_recommended
race.announcement.published
race.aid_station.updated
race.course.updated
race.results.published
race.tracking.started

Race events

The race.* events tell a companion app that a published race's official data changed, so it can read the race data API again. They carry only public data: the race, when it happened, and a small summary of the change. Your organization's subscriptions receive its own races; outside apps with a Wolfe Run developer key receive them through Wolfe Run once the organizer has open data on. See the race data terms.

{
  "id": "race.announcement.published:evt_123:cmp_456",
  "type": "race.announcement.published",
  "apiVersion": "2026-08-24",
  "createdAt": "2026-07-31T14:05:00.000Z",
  "organizationId": "org_123",
  "data": {
    "occurredAt": "2026-07-31T14:05:00.000Z",
    "event": { "id": "evt_123", "slug": "crazymountain100", "name": "Crazy Mountain 100", "url": "https://crazymountain100.endurancehq.app" },
    "announcement": { "id": "cmp_456", "kind": "announcement", "title": "Course change at mile 40", "urgent": true, "postedAt": "2026-07-31T14:05:00.000Z" }
  }
}

Verify a delivery

Compute HMAC-SHA256 over webhook-id.webhook-timestamp.raw-body with the signing secret, then compare it to the base64 digest in webhook-signature.

webhook-id: event_123
webhook-timestamp: 1787437902
webhook-signature: v1,base64_digest

Endpoint requirements

Endpoints must use public HTTPS. Redirects, private networks, loopback addresses, link-local addresses, and reserved DNS targets are rejected.