A webhook sends a signed POST to a URL you own when a job finishes, so Zapier, Make, your CMS or your own code can take the result anywhere. Nothing is installed on your site.
Events: scan.done (a page scan finished), brief.done (a keyword brief is ready), page.done (a new page is written and scored), page.published (a page went live), repair.done (a page repair is ready), autopilot.run (an Autopilot run finished) and lead.new (a new lead arrived). Add a webhook per site, or one for the whole account, with an https address and the events you want. The secret is shown once when you create the webhook; copy it then.
Checking the signature: every delivery carries three headers. X-E8-Event is the event name, X-E8-Delivery is the delivery number, and X-E8-Signature is the HMAC-SHA256 of the raw request body using your secret, as lowercase hex. To check it, take the body exactly as received (do not re-encode it), compute HMAC-SHA256 with your secret, and compare the hex result with the header using a constant-time compare. The body is JSON: event, delivery_id, account_id, site (id and domain), data (the job as the API returns it) and sent_at.
Retries: any answer other than a 2xx status is retried after 1 minute, 10 minutes, 1 hour, 6 hours and 24 hours, then marked failed. Ten failures in a row switch the webhook off and email the account owner; switch it back on once the endpoint is fixed. Use Test to send a ping and see the response code, and the log to see every delivery.
