Skip to main content
With a webhook subscription, Bottari sends a POST to your address when something the integration can read changes. The body has no content, only IDs and the kind of change. Your server calls the API with those IDs to read the latest values. Each integration has one subscription. If you need two addresses, create two integrations. Only team owners can manage subscriptions.

​
Create a subscription

1

Prepare your server

Make sure your address answers POST requests with a 2xx and that you can read verification_token from the body. Verify signatures has an example.
2

Create the subscription

Under Webhook on the integration’s page, below Connected databases, select Create subscription. Enter the Receiving address and choose Events to receive. All events start selected, and the API version is fixed at 2026-03-11.To receive comment.* events, also turn on Read comments under Capabilities.
3

Receive the verification token

Bottari sends the verification token to that address in a POST.
If your server received the token, you can verify even if it answered with something other than a 2xx.
4

Enter the token in the app

Select Verify and enter the token. When the status changes to On · API version 2026-03-11, changes made from then on send events. Changes made before verification don’t.
5

Store the token

Add the verification token to your server’s environment.
The verification token is the key for verifying signatures. It never appears again in the app or the API.

​
Before verification

A wrong token shows That token doesn’t match.

​
After verification

If you lose a verified token, delete the subscription and create a new one. Deleting an integration also deletes its subscription. Failed deliveries on the integration’s page shows the failure count and the last failure time. See Retries and automatic pause.

​
Receiving address rules

  • Only https is accepted.
  • Up to 2,048 characters.
  • It has to be a public address. Hosts that resolve to a private address are rejected.
  • It can’t include a username or password, such as https://user:pass@example.com.
  • Hosts that can’t be resolved are rejected.
  • Redirects aren’t followed. A 3xx counts as a failure.

​
Read back after an event

IDs in an event match what the API returns, so you can read them directly. A trashed row returns 200 with in_trash: true. A deleted block’s ID from updated_blocks returns 404.