Coding agent documentation index Fetch the complete documentation index at: https://docs.worklittle.com/docs-agent-manifest.json Use this file to discover all available pages before exploring further.

Webhooks overview

Webhooks send HTTPS POST requests to your server when hiring events happen in your Worklittle organization, so you can sync an HRIS or trigger workflows without polling.

Create an endpoint

Register an HTTPS URL and the events you want. Worklittle then POSTs a JSON payload to it for each matching event.

curl -s -X POST "https://api.worklittle.com/webhooks" \
  -H "Authorization: Bearer $WORKLITTLE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "HRIS sync",
    "url": "https://example.com/hooks/worklittle",
    "event_types": ["candidate.application_submitted", "candidate.stage_changed"]
  }'

The 201 response includes webhook and signing_secret (whsec_...). Store the secret, you need it to verify signatures. The key needs the webhooks:manage scope.

| Field | Type | Description |
| --- | --- | --- |
| `url` | string | Required. Must be an HTTPS URL. |
| `name` | string | Label, up to 200 characters. |
| `event_types` | string[] | Events to receive. Omit it, or send `["*"]`, for all events. Unknown types are ignored, and if none are valid you get all events. |

Send a test event with POST /webhooks/:id/test. It queues a webhook.test delivery and returns { queued_deliveries }.

Event types

Subscribe to any of these, or "*" for all.

| Category | Types |
| --- | --- |
| Candidates | `candidate.application_submitted`, `candidate.updated`, `candidate.contact_updated`, `candidate.deleted`, `candidate.stage_changed`, `candidate.became_employee`, `candidate.note_created`, `candidate.bookmarked`, `candidate.unbookmarked`, `candidate.skills_match` |
| Employees | `employee.created`, `employee.updated`, `employee.benefits_updated`, `employee.compensation_changed`, `employee.department_changed`, `employee.title_changed`, `employee.offboarding`, `employee.tenure_reached`, `employee.birthday_today`, `employee.pto_low`, `employee.pto_unused_this_month`, `employee.pto_year_end_remaining`, `employee.compensation_above_market`, `employee.language_added`, `employee.title_matches` |
| Attendance | `attendance.sick_day_marked`, `attendance.pto_used`, `attendance.unavailable_marked`, `attendance.available_marked`, `attendance.available_on_weekend`, `attendance.entry_updated` |
| Documents | `document.created`, `document.updated`, `document.published`, `document.shared`, `document.signed`, `document.deleted` |
| Jobs | `job.created`, `job.updated`, `job.closed`, `job.published`, `job.compensation_above_market` |
| Offers | `offer.created`, `offer.updated`, `offer.accepted`, `offer.denied`, `offer.deleted`, `offer.compensation_above_market` |
| Surveys | `survey.created`, `survey.response_submitted`, `survey.sentiment_average_below`, `survey.response_count_reached`, `survey.deleted` |
| Organization | `organization.member_joined`, `organization.member_role_changed`, `organization.member_left` |
| Plugins | `plugin.event_received` |
| Test | `webhook.test` (sent by `POST /webhooks/:id/test`) |

survey.sentiment_average_below and survey.response_count_reached use thresholds you set in the automation trigger.

Delivery and retries

A delivery succeeds on any 2xx response. Anything else, including a network error, is retried with exponential backoff.

| Failed attempt | Earliest next attempt |
| --- | --- |
| 1 | 1 minute |
| 2 | 2 minutes |
| 3 | 4 minutes |
| 4 | 8 minutes |
| 5 | 16 minutes |
| 6 | None. The delivery is marked `failed`. |

After 20 failed attempts in a row, the endpoint is disabled with reason too_many_failures. A successful delivery resets the count. Rotating the secret re-enables the endpoint.

REST routes

| Method | Path | Description |
| --- | --- | --- |
| GET, POST | `/webhooks` | List or create endpoints |
| GET, PATCH, DELETE | `/webhooks/:id` | Read, update (`name`, `url`, `event_types`, `status`), or delete |
| POST | `/webhooks/:id/secret` | Rotate the signing secret. Returns the new `signing_secret`. |
| POST | `/webhooks/:id/test` | Send `webhook.test` |
| GET | `/webhook-deliveries?endpoint_id=&limit=` | Delivery log. `limit` defaults to 50. |

MCP: list_webhooks, create_webhook, update_webhook, delete_webhook, rotate_webhook_secret, test_webhook, list_webhook_deliveries. They use the same Bearer key as REST.