Webhooks

Outbound webhook subscriptions and inbound webhook endpoints — Intercom, providers, custom.

Webhooks

Outbound subscriptions

GET/POST /workspaces/{org}/webhook-subscriptions — subscribe a URL to workspace events (issue created/updated, ticket events, deal changes). Each subscription has a signing secret; deliveries are retried on failure.

Verify signatures the standard way: HMAC-SHA256(secret, timestamp + "." + body) in the X-Pile-Signature header.

Inbound endpoints

Provider webhooks mount at root, publicly routed but signature-verified:

• POST /intercom/{organizationId} — Intercom events → tickets
• POST /support/sms/inbound — Sendblue SMS → the SMS concierge thread
• POST /gitlab — GitLab events

Custom inbound automation uses the same pattern: verify signature → create ticket/event → let the workspace feed take it from there.