Webhooks Overview
Send real-time notifications to external systems when hiring events happen.
Why It Matters
Webhooks push event data to your systems the moment something happens — a candidate applies, an interview is scheduled, a job posting goes live. Instead of polling an API, your integrations receive instant HTTP callbacks with the full event payload.
What You Need
- A Kit account with admin access
- An HTTPS endpoint that can receive POST requests
Setup
Navigate to Integrations > Webhooks, click New Webhook, and fill in:
| Field | Required | Description |
|---|---|---|
| URL | Yes | The HTTPS endpoint that will receive events |
| Description | No | A label to help you identify this webhook |
| Events | Yes | Which event types to subscribe to |
Select individual events or subscribe to entire categories. Click Create Webhook to save. Kit generates a signing secret you’ll use to verify payloads.
Available Events
Kit fires webhooks across eight categories. These are the exact event types you can subscribe to in the webhook editor. For the full payload shape of each event, see the Webhook Events Reference.
Application Events
| Event | Fires When |
|---|---|
application.submitted |
A candidate submits an application |
application.rejected |
An application is rejected |
application.rejection_reverted |
A previously rejected application is reinstated |
application.advanced |
An application advances to the next stage |
application.withdrawn |
A candidate withdraws their application |
application.offer_extended |
An offer is extended to a candidate |
Offer Events
| Event | Fires When |
|---|---|
offer.accepted |
An admin accepts an offer on the candidate’s behalf |
offer.declined |
An admin declines an offer on the candidate’s behalf |
Interview Events
| Event | Fires When |
|---|---|
interview.scheduled |
An interview is scheduled |
interview.confirmed |
A candidate confirms the interview |
interview.completed |
An interview is marked as completed |
interview.cancelled |
An interview is cancelled |
interview.no_show |
A candidate is marked as a no-show |
Code Assignment Events
| Event | Fires When |
|---|---|
code_assignment.submitted |
A candidate submits their code assignment |
code_assignment.auto_submitted |
A code assignment is auto-submitted at deadline |
Review Events
| Event | Fires When |
|---|---|
review.submitted |
A team member submits a review |
Job Posting Events
| Event | Fires When |
|---|---|
job_posting.published |
A job posting is published |
job_posting.paused |
A job posting is paused |
job_posting.closed |
A job posting is closed |
job_posting.reopened |
A job posting is reopened |
CSIRT Report Events
| Event | Fires When |
|---|---|
csirt.report.submitted |
A researcher submits a vulnerability report |
csirt.report.triaged |
A report is triaged |
csirt.report.validated |
A report is validated |
csirt.report.resolved |
A report is resolved |
csirt.report.fix_verified |
A report’s fix is verified |
csirt.report.paid |
A bounty is paid out |
csirt.report.dismissed |
A report is rejected |
csirt.report.informative |
A report is closed as informative — valid, but nothing to fix |
CSIRT webhooks track the report’s status as it moves through the lifecycle. Actions that don’t change the status — assessing severity, assigning an owner, approving a bounty — do not fire a webhook of their own. Subscribe to the surrounding status events instead.
csirt.report.dismissed and csirt.report.informative are both closes and are not interchangeable: a dismissed report was rejected, while an informative one is a valid finding with nothing to fix, and it may still be paid a discretionary bonus. If your integration treats “closed” as “invalid”, subscribe to the two separately.
Outreach Events
| Event | Fires When |
|---|---|
outreach.prospect.drafted |
A message is drafted for a prospect |
outreach.message.approved |
An outreach message is approved |
outreach.message.sent |
An outreach message is sent |
outreach.message.bounced |
An outreach message bounces |
outreach.message.failed |
An outreach message fails to send |
Managing Webhooks
Each webhook shows its status, subscribed events, and recent delivery history.
- Pause — Stop deliveries. Events that fire while paused are not queued.
- Resume — Re-enable a paused or auto-disabled webhook. Resets the failure counter.
- Edit — Change the URL, description, or subscribed events.
- Rotate Secret — Generate a new signing secret. Update your endpoint before rotating.
- Delete — Permanently remove the webhook and its delivery history.
Testing Your Endpoint
Click Send Test Ping on any webhook to send a test.ping event to your endpoint. Use it to verify connectivity and signature validation before subscribing to real events.
The Deliveries tab shows request headers, response status, and timing for each delivery attempt.
Quick Checklist
- Navigate to Integrations > Webhooks
- Add your HTTPS endpoint URL
- Select the events you want to receive
- Copy your signing secret
- Send a test ping to verify connectivity
- Implement signature verification in your endpoint
-
Return a
2xxstatus code to acknowledge receipt