Webhook

A Webhook is a setting that sends an HTTP request to a pre-specified external URL when something happens in a Space (for example, a Content is created or published). You use it for integrating external systems or for automation. For instance, you can configure it to call your internal notification server, or to call an external API, every time a product Content is published.

A Webhook does not stop at sending a request. It can also be configured with WriteBack, which takes the response and writes it back into Content or Media. This is how you build an asynchronous job flow that absorbs the result of an external API into the data inside your Space. A Webhook is a sub-resource of Space in CMA, and its path is based on /spaces/{spaceId}/webhooks.

Resource structure

The following is the single-read response for the Webhook "Product change notification". Along with sys (system properties), it has setting fields such as the delivery target, the subscribed events, and the trigger conditions.

{
  "sys": {
    "id": "3trmXRM3RqbgSnifyg7PWhk01Examp",
    "type": "Webhook",
    "space": { "sys": { "id": "tcq4V2Xb", "type": "Refer", "targetType": "Space" } },
    "createdBy": { "sys": { "id": "3p4tcFbQRwz503VXdtHXNI5dZH5TVB", "type": "Refer", "targetType": "User" } },
    "createdAt": "2026-06-18T11:30:00.000Z",
    "updatedBy": { "sys": { "id": "3p4tcFbQRwz503VXdtHXNI5dZH5TVB", "type": "Refer", "targetType": "User" } },
    "updatedAt": "2026-06-18T11:30:00.000Z",
    "version": 1
  },
  "name": "Product change notification",
  "filters": [
    { "doc": "sys.contentType.sys.id", "op": "EQ", "value": "3trmXRM3RqbgSnifyg7PAmlxvX4fGY" }
  ],
  "headers": [
    { "key": "X-Source", "value": "weegloo", "secret": false }
  ],
  "httpBasicUsername": "dailywear",
  "topics": ["Content.Create", "Content.Publish"],
  "transformation": { "method": "POST", "contentType": "application/json", "includeBody": true },
  "url": "https://api.dailywear.example/webhooks/products",
  "activate": true
}

Key properties:

• sys.id: The unique identifier of the Webhook. It goes into {webhookId} in the single-read, update, and delete paths.
• url: The external target URL to call when an event occurs.
• topics: An array that defines which events to subscribe to. The format is explained in topics below.
• filters: The conditions that actually trigger the Webhook among the subscribed events. Explained in filters below.
• transformation: A setting that changes the shape of the outgoing request (method, body, and so on). Explained in transformation below.
• writeBacks: An array of jobs that take the external response and write it back into Content or Media. It is not present in the example above. Explained in writeBacks below.

System properties (sys)

Every Webhook carries its common system properties in the sys object. space, createdBy, and updatedBy come in the Refer shape ({ "sys": { "id", "type": "Refer", "targetType" } }).

A Webhook is a settings resource, so it has no concept of publishing. Unlike Content or Content Type, it has no publishing-state properties such as publish, archive, or status, only a version for change tracking. Turning it on and off is not controlled by publishing but by the body field activate.

Body properties

The body of a Webhook (the setting values you send on create and update, and that come back in the response) is made up of the following fields.

Each item in headers is made up of key (required), value (required), and secret (optional, boolean). A header whose secret is true has its value masked in the response. Put values that must not be exposed, such as API keys, in secret: true headers.

topics

Each item in topics has the format {resource}.{action}. For example: Content.Create, Content.Publish, Media.Create.

The action is one of the following, or *, which means all actions of the resource (for example, Content.*).

filters

filters is an array that narrows down which of the subscribed topics actually trigger the Webhook. Each filter has the following shape.

{ "doc": "sys.contentType.sys.id", "op": "EQ", "value": "3trmXRM3RqbgSnifyg7PAmlxvX4fGY" }

• doc: The field path to compare. It is one of sys.id, sys.contentType.sys.id, sys.createdBy.sys.id, or sys.updatedBy.sys.id.
• op: The comparison operator. It is one of EQ, NE, IN, NOT_IN, REGEX, or NOT_REGEX.
• value: The comparison value. Give a string for EQ, NE, REGEX, NOT_REGEX, and an array of strings for IN, NOT_IN.

If you set several filters, all of them must be satisfied to trigger (AND). If you leave filters empty, every event of the subscribed topics triggers.

transformation

transformation changes the shape of the outgoing HTTP request. If you do not specify it, the entire resource payload goes out as-is with the default POST.

writeBacks

writeBacks is an ordered array of jobs that take the external response received by the Webhook and write it back into Content or Media. They run in order only when the external API responds with 2xx. Each item has exactly one of $content (WriteBackContent) or $media (WriteBackMedia).

The keys of WriteBackContent ($content):

The keys of WriteBackMedia ($media):

The following is a writeBacks example that extracts values from the external response JSON and creates one Content.

"writeBacks": [
  {
    "$content": {
      "action": "Create",
      "contentType": { "sys": { "id": "3trmXRM3RqbgSnifyg7PAmlxvX4fGY" } },
      "locale": "en-US",
      "fields": {
        "productName": "{ /response/title }",
        "price": "{ /response/price }"
      },
      "publish": true,
      "unpublish": true
    }
  }
]

{ /response/... } is a JSON Pointer template that extracts a value from the response JSON received by the Webhook. The keys of fields (productName, price) are the apiName of the target Content fields. The example above fills the response's title into the Content's productName and price into price, then creates and publishes the Content.

API

The base URL for all endpoints below is https://cma.weegloo.com/v1, and the Authorization header needs a Bearer token that authenticates against CMA. Update (PUT) and partial update (PATCH) must also send the X-Weegloo-Version header (the current resource's sys.version) for optimistic concurrency control.

Related documents

• Content: The body data that triggers a Webhook or that WriteBack writes.
• Media: The file resource that WriteBack can create.
• SpaceRole: For limiting access to a Webhook job's Content with :self.