> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.hodi.host/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# How do I receive a webhook notification after each deployment?

Hodiploy can call a URL of yours after every deployment on an instance, successful or not. This outgoing webhook is meant for automation: feed a monitoring tool, post to Slack or Teams through a relay such as Zapier, Make or n8n, trigger a test suite, or anything else an HTTP request can start.

|| Not to be confused with the *incoming* Git webhook, the URL you add to your repository so that a push deploys your code. This one goes the other way: Hodiploy calls **you** once the deployment is done.

## When does it fire?

A request is sent after each **finished** deployment, whether it succeeded or failed:

* **Git deployment**: a push to the connected branch redeployed your code (see [Does Hodiploy support deployment via Git?](https://help.hodi.host/en/article/does-hodiploy-support-deployment-via-git-9w70mc/))
* **Odoo update**: the Odoo image of your instance was updated, whether you triggered it manually or it ran on a schedule (see [Can I schedule updates for my Odoo instance?](https://help.hodi.host/en/article/can-i-schedule-updates-for-my-odoo-instance-7s8bi9/)). A scheduled check that finds **no update available sends nothing**: the webhook only speaks when your instance actually changed, or tried to

The webhook is completely independent from the **"E-mail alert"** setting: you can enable either one, both, or neither.

## How do I enable it?

1. Open your instance's **edit page**
2. In the **"Instance settings"** section, find **"Deployment webhook"**
3. Paste the URL to call. It must be a **public http:// or https:// address**, reachable from the internet: local or private network addresses are refused
4. Optionally, set a **signing key** so you can verify that the requests really come from Hodiploy (see below)
5. Save

To disable it, clear the URL and save.

## What is sent?

A **POST** request in JSON, with these headers:

* `Content-Type: application/json`
* `X-Hodiploy-Event`: the event and its outcome, one of `git_deploy.success`, `git_deploy.failed`, `erp_update.success`, `erp_update.failed`
* `X-Hodiploy-Signature`: only when a signing key is set, see below

The body always has the same shape; fields that do not apply to the event are `null`. For example, after a successful Git deployment:

```json
{
  "event": "git_deploy",
  "state": "success",
  "instance_id": "0b6e2f7a-9c1d-4a52-8f3e-1d2c3b4a5e6f",
  "name": "my-odoo",
  "url": "https://my-odoo.example.com",
  "tool": "odoo",
  "version": "19.0",
  "repo": "git@github.com:acme/odoo-addons.git",
  "branch": "main",
  "commit_ref": "4f2a1c9e8b7d6a5f4e3d2c1b0a9f8e7d6c5b4a39",
  "commit_message": "Fix invoice report",
  "version_from": null,
  "version_to": null,
  "image_from": null,
  "image_to": null,
  "error_message": null,
  "finished_at": "2026-08-25T14:03:07.000Z"
}
```

* `state` is `success` or `error`; on `error`, `error_message` says what went wrong
* For an **Odoo update** (`event: "erp_update"`), the commit fields are `null` and `version_from` / `version_to` carry the full version before and after (for example `19.0-20260801` to `19.0-20260817`), with `image_from` / `image_to` holding the image digests

Your endpoint should answer with a 2xx status within **10 seconds**. A failed or slow delivery is logged on our side but **never retried**, and it never delays or fails the deployment it reports. Redirects are not followed.

## Verifying the signature

If you set a signing key, every request carries a `X-Hodiploy-Signature` header of the form `sha256=<hexadecimal>`: the **HMAC-SHA256** of the raw request body, computed with your key. Recompute it on your side and reject anything that does not match. For example in Node.js:

```js
const crypto = require("crypto");

function isFromHodiploy(rawBody, signatureHeader, key) {
  const expected = "sha256=" +
    crypto.createHmac("sha256", key).update(rawBody).digest("hex");
  return signatureHeader === expected;
}
```

Compute the HMAC over the **raw** body, exactly as received, before any JSON parsing or re-serialisation.

## A question about the webhook?

If you'd like to see [Hodiploy in action](https://hodiploy.app/api/demo) before getting started, or if you have a question about wiring the webhook into your tools, [contact us](https://hodi.host/contact/), our team will be happy to help you.