Skip to main content
Webhooks in Notra are inbound. GitHub sends events to Notra so that event triggers can generate content the moment a release is published or commits land on the default branch.
Notra does not send outbound webhooks to your servers. There is no way to register a callback URL, and Notra never signs or delivers events to third-party endpoints. To react to things that happen in Notra, poll the job endpoints or read the agent session stream. See No outbound webhooks below.

Inbound webhooks from GitHub

GitHub is the only provider with a working webhook setup. Linear, Slack, and the other integrations connect through their APIs and do not use this endpoint.

Payload URL

Each connected repository gets its own payload URL:
The dashboard generates this URL for you. Copy it from the Setup Webhook dialog rather than assembling it by hand: the IDs are internal and the URL is checked against the organization and integration on every delivery.

Set up the webhook

1

Open the repository in Notra

Go to Integrations, then GitHub, and open the repository you connected. Notra also shows the Setup Webhook dialog right after you add a repository.
2

Copy the Payload URL and Secret

The dialog shows three values: the Payload URL, the content type (application/json), and the Secret. A secret is generated automatically the first time you open the dialog. Use the copy buttons; the secret is masked until you focus the field.
3

Add the webhook on GitHub

In your repository on GitHub, open Settings, then Webhooks, then Add webhook. Paste the Payload URL, set the content type to application/json, paste the Secret, and choose Let me select individual events. Select Pushes and Releases. You can also select Pull requests if you want merged pull requests recorded for Iris.
4

Confirm in Notra

Click I’ve added the webhook. GitHub sends a ping event as soon as the webhook is saved; Notra answers it and writes a log entry so you can confirm the connection worked.
Without a webhook you can still generate content manually, on a schedule, or through POST /v1/posts/generate. Webhooks are only needed for event triggers.

Rotate the secret

Open the repository page in Notra and use Regenerate in the webhook section. The old secret stops working immediately, so update the webhook on GitHub right after regenerating.

Security

Notra verifies every delivery before reading the payload:
  • Signature: GitHub signs the body with HMAC SHA-256 using your secret and sends it in the X-Hub-Signature-256 header. Notra recomputes the signature and compares it in constant time. A missing header returns 400; a mismatch returns 401.
  • Ownership checks: The organization, integration, and repository IDs in the URL must match each other. Deliveries to a disabled integration, or with IDs that do not belong together, are rejected with 403.
  • Deduplication: The X-GitHub-Delivery header is remembered for 24 hours. A redelivery of the same ID returns 200 with "duplicate": true and is not processed again.

Responses

Notra answers every delivery with JSON. GitHub shows the body under Recent Deliveries in your webhook settings.

Error responses

error
Invalid URL parameters, missing X-GitHub-Event or X-Hub-Signature-256 header, no webhook secret generated for the repository yet, or a body that is not valid JSON in the expected shape.
error
The signature does not match the repository’s secret. Regenerate the secret in Notra and update GitHub if they drifted apart.
error
The integration is disabled, does not belong to the organization in the URL, or the repository does not belong to the integration.
error
The integration or repository was deleted.
error
Notra could not finish processing the delivery. GitHub keeps the delivery in its history so you can redeliver it from the webhook settings page.
error
The provider segment in the URL is not github.

Logs

Every delivery, including rejected ones, is written to Settings, then Logs in the dashboard with its status, HTTP status code, GitHub delivery ID, and payload summary. Retention is 7, 14, or 30 days depending on your plan.

No outbound webhooks

Notra does not push notifications when a post is generated, a brand identity finishes analyzing, or a GEO scan completes. Use these instead:

Poll post generation

GET /v1/posts/generate/{jobId} returns the job and its event log. Stop polling when job.status is completed, failed, or skipped; job.postId is set on completion.

Poll brand analysis

GET /v1/brand-identities/generate/{jobId} reports queued, running, completed, or failed along with the current step.

Poll GEO scans

POST /v1/projects/{projectId}/geo/scans returns a statusUrl and a Location header. Poll GET /v1/projects/{projectId}/geo/scans/{scanId} until scan.status leaves running.

Stream agent sessions

GET /v2/eve/v1/session/{sessionId}/stream is a durable, replayable newline-delimited JSON stream. Pass startIndex to resume from a known position.
Polling counts against the standard per-key rate limits. Ten seconds between checks is plenty; generation jobs usually take a few minutes.

Next steps

Event reference

Which GitHub events Notra processes, how they are filtered, and what the processed payload looks like

Event triggers

Turn webhook events into generated content
Last modified on September 2, 2026