Webhooks let another system react to what happens on a board. When a subscribed event occurs, KanbanWP sends an HTTP POST with a JSON body to the URL you provide.
Events
| Event key | Sent when |
|---|---|
task_created | A task is created. |
task_updated | A task’s fields change. |
task_moved | A task moves to another stage. |
task_deleted | A task is deleted. |
comment_added | A comment is added to a task. |
board_created | A board is created. |
A webhook belongs to one board and listens for events on that board. You can subscribe to specific events, or to all of them (*).
Set up a webhook
- Go to KanbanWP > Webhooks. You need permission to manage the board.
- Under Add Webhook, choose the Board.
- Enter the Payload URL. It must be a valid address, ideally HTTPS.
- Tick the Events you want. Leaving all boxes unticked subscribes to every event.
- Keep Active ticked and click Add Webhook.
The Existing Webhooks table lists each hook with its board, URL, events and active state, plus Edit and Delete links. You can switch a hook off with Active without deleting it.
The request
Each delivery is a POST with Content-Type: application/json and these headers:
X-KanbanWP-Event: the event key, such astask_moved.X-KanbanWP-Signature:sha256=followed by a hex HMAC.X-KanbanWP-Delivery: a unique delivery ID.
The body looks like this:
{
"event": "task_moved",
"site": "https://example.com",
"board_id": 3,
"task_id": 41,
"data": {
"task": { "id": 41, "title": "Draft launch post" },
"old_stage_id": 12,
"new_stage_id": 13
},
"sent_at": "2026-10-13T09:30:00+00:00"
}The data object depends on the event. Task events include the task. task_updated adds changes, task_moved adds the old and new stage IDs, comment_added includes the comment, and board_created includes the board. The payload can be changed by developers with the kanbanwp_webhook_payload filter.
Verify the signature
Each webhook has its own secret, generated when the webhook is created. The signature is an HMAC-SHA256 of the raw request body, keyed with that secret. Compute it on your side and compare it with the header using a constant-time comparison.
$expected = 'sha256=' . hash_hmac( 'sha256', $raw_body, 'YOUR_WEBHOOK_SECRET' );
$valid = hash_equals( $expected, $_SERVER['HTTP_X_KANBANWP_SIGNATURE'] );The admin screen shows only the first eight characters of a secret, never the whole value. If you need the full secret, create the webhook through the REST API: the response to that request includes the secret once. In the admin, you can tick Rotate secret when editing to generate a new one.
Delivery behavior
- Requests are sent in the background with a five second timeout. KanbanWP does not wait for your reply and does not retry.
- If the request cannot be sent at all, a failure entry is added to the board’s activity log. A slow or error response from your server is not recorded.
- Respond quickly, and do heavy work after you answer.
Developer access
Webhooks can also be listed, created, updated and deleted through the REST API, which is handy for scripted setup. See the REST API.