Coding agent documentation index Fetch the complete documentation index at: https://docs.worklittle.com/docs-agent-manifest.json Use this file to discover all available pages before exploring further.

Webhook integration

Verify signatures, parse payloads, and handle retries safely in your application.

Payload shape

Each delivery is JSON with an event id, type, timestamp, and data object:

{
  "id": "wh_…",
  "type": "candidate.application_submitted",
  "created_at": 1748948400,
  "data": { }
}

created_at is Unix seconds (not an ISO string).

Respond with 2xx quickly. Do heavy work asynchronously.

Job board cache invalidation

job.published, job.updated, and job.closed include board-friendly fields alongside job:

| Field | Notes |
| --- | --- |
| `public_job_id` | Hosted index id (`job.job_id`) |
| `slug` | Public careers slug |
| `organization.slug` | Employer board slug |
| `public_visible` | Whether the role appears on the org homepage list |
| `accepting_applicants` | Whether apply is open |

Revalidate your /careers index and /careers/{slug} pages on these events.

Signature headers

| Header | Purpose |
| --- | --- |
| `Worklittle-Webhook-Id` | Unique delivery id (dedupe) |
| `Worklittle-Webhook-Timestamp` | Unix timestamp |
| `Worklittle-Webhook-Signature` | `v1=<hmac>` over `timestamp.body` |

Reject requests older than a few minutes to limit replay attacks.

Verify in Node

import crypto from "node:crypto";

function verify(sigHeader, timestamp, rawBody, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");
  const received = sigHeader.replace(/^v1=/, "");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received));
}

Read the raw body before JSON parsing so the signature matches.

MCP management

create_webhook, list_webhooks, test_webhook, and list_webhook_deliveries use the same Bearer key as REST for agent-driven setup.