Webhooks

Webhooks send what happens in AI Puffer to your own systems as JSON: a chat starts, a form is sent, an article is written. For Slack, HubSpot, Notion and similar apps without code, use Connected apps (Pro) instead.

Set up

1. Open Settings › For developers › Webhooks and switch on Send events. A signing secret is made for you.
2. Select Add an endpoint, give it a Name and URL.
3. Tick what it receives, or All.
4. Send a test event checks that your endpoint answers.

Each endpoint has its own Sending switch to pause it.

Events

Event	When
chatbot.session_started	A chat starts
chatbot.user_message_submitted	Someone sends a message
chatbot.response_generated	The chatbot replies
chatbot.fb_submitted	Someone rates a reply
chatbot.form_submitted	Someone sends a chatbot form (Pro)
content.generated	Content is written
task.item_completed	An automation finishes an item
form.submitted	Someone sends an AI form
image.generated	An image is made
kb.source_indexed	A source is added to the knowledge base

What arrives

A POST with a JSON body:

{
  "id": "…", "type": "form.submitted", "schema_version": "2026-05-21",
  "occurred_at": "2026-10-15T09:12:00Z", "idempotency_key": "…",
  "site": { "url": "…", "name": "…" },
  "source": { "module": "ai_forms", "origin": "…" },
  "data": { … }
}

Headers include X-AIPKit-Event, X-AIPKit-Event-Id, X-AIPKit-Idempotency-Key, X-AIPKit-Timestamp and X-AIPKit-Signature.

Check the signature

The signature is sha256= followed by the hex HMAC-SHA256 of the timestamp, a dot, and the raw body, using your signing secret:

const expected = 'sha256=' + crypto.createHmac('sha256', secret)
  .update(req.headers['x-aipkit-timestamp'] + '.' + rawBody).digest('hex');

Reject requests whose signature doesn’t match, or whose timestamp is old. Make a new secret replaces the secret at once.

Retries

Answer with any 2xx status. Network errors, 408, 409, 425, 429 and 5xx are tried again, up to three times; other errors aren’t. A retry sends the same event again, so use X-AIPKit-Idempotency-Key to ignore duplicates. Failed sends are listed under the endpoint with Send it again and Dismiss.