REST API Reference

Events

Payload

Webhooks are sent as POST requests with a JSON body:

{
  "event": "article.published",
  "timestamp": "2026-03-20T12:00:00.000Z",
  "data": {
    "id": "abc123",
    "title": "How to Optimize for AI Search",
    "slug": "how-to-optimize-for-ai-search",
    "status": "published",
    "excerpt": "A comprehensive guide...",
    "metaDescription": "Learn how to optimize...",
    "content": "<p>Full HTML content...</p>",
    "featuredImageUrl": "https://example.com/image.jpg",
    "scheduledAt": null,
    "publishedAt": "2026-03-20T12:00:00.000Z",
    "priority": "medium",
    "wordCount": 1200,
    "readingTimeMinutes": 5,
    "createdAt": "2026-03-19T10:00:00.000Z",
    "updatedAt": "2026-03-20T12:00:00.000Z",
    "metadata": {
      "articleType": "guide",
      "description": "A comprehensive guide to AI search optimization"
    }
  }
}

Signature Verification

If you configure a signing secret, every webhook request includes an X-Webhook-Signature header containing an HMAC-SHA256 hex digest of the request body signed with your secret.

// Node.js example
import { createHmac } from "crypto";

function verifyWebhook(body: string, signature: string, secret: string): boolean {
  const expected = createHmac("sha256", secret)
    .update(body)
    .digest("hex");
  return signature === expected;
}

// In your webhook handler
app.post("/webhooks/chatfeatured", (req, res) => {
  const signature = req.headers["x-webhook-signature"];
  const body = JSON.stringify(req.body);

  if (!verifyWebhook(body, signature, process.env.WEBHOOK_SECRET)) {
    return res.status(401).send("Invalid signature");
  }

  const { event, data } = req.body;

  switch (event) {
    case "article.review":
      console.log(`Article "${data.title}" is ready for review`);
      break;
    case "article.published":
      console.log(`Article "${data.title}" has been published`);
      break;
  }

  res.status(200).send("OK");
});