Skip to main content

Webhooks

Plan requirement

Webhooks are available on the Enterprise plan.

Webhooks let you receive an HTTP POST request to your own server whenever a specific event occurs in the platform. Use them to sync data with external systems such as HubSpot, Slack, or your HRMS — without polling the API.

Available events​

EventTriggered when
user.enrolledA student is enrolled in a course
user.completedA student completes a course (100% progress)
certificate.issuedA certificate is generated for a student
user.invitedAn admin sends an invitation email to a new user
user.registeredA new user completes registration
plan.upgradedYour organization upgrades to a higher plan
batch.student_addedA student is added to a batch
quiz.passedA student passes a quiz
quiz.failedA student fails a quiz

Add an endpoint​

  1. Go to Settings → Webhooks
  2. Click Add Endpoint
  3. Enter the URL of your server endpoint (must be HTTPS)
  4. Select the events you want to receive
  5. Click Save

The platform immediately sends a test ping event to verify the endpoint is reachable. A green checkmark confirms success.

Payload format​

Each webhook is an HTTP POST with a JSON body:

{
  "event": "user.enrolled",
  "timestamp": "2026-05-09T10:34:00Z",
  "data": {
    "student_id": "usr_abc123",
    "student_email": "jane@example.com",
    "student_name": "Jane Smith",
    "course_id": "crs_xyz789",
    "course_title": "Onboarding 101",
    "enrolled_at": "2026-05-09T10:34:00Z"
  }
}

The data object contains fields relevant to the event type. All timestamps are ISO 8601 in UTC.

Verifying the signature​

Every webhook request includes an X-LMS-Signature header. This is an HMAC-SHA256 signature of the raw request body, signed with your endpoint secret.

To verify on your server:

  1. Copy the secret shown on the endpoint detail page in Settings
  2. Compute HMAC-SHA256(secret, rawRequestBody)
  3. Compare your computed signature to the value in X-LMS-Signature
  4. If they match, the request is genuine

Example in Node.js:

const crypto = require('crypto');

function verifySignature(secret, rawBody, headerSignature) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(headerSignature)
  );
}
warning

Always verify the signature before processing a webhook. Reject requests that fail signature verification.

Delivery logs and retry​

The platform logs every delivery attempt. To view logs:

  1. Go to Settings → Webhooks → [Your endpoint]
  2. Click the Delivery Logs tab

Each log entry shows the event, timestamp, HTTP response code your server returned, and delivery status.

Retry policy: If your server returns a non-2xx response or does not respond within 10 seconds, the platform retries with exponential backoff at 1 min, 5 min, 30 min, and 2 hours. After 4 failed attempts, the delivery is marked as failed.

  • HubSpot / CRM — create a contact activity when user.enrolled or user.completed fires
  • Slack — post a message to a channel when certificate.issued fires
  • HRMS / HR systems — sync course completions to your training records system
  • Zapier — use webhooks as a trigger in a Zap to connect to 5,000+ apps