Product · Webhooks
Your site refreshes itself
Add a webhook per site and HelmCMS calls it when entries are published, unpublished or deleted. Every delivery is signed, retried on failure and logged.
Part of our guide Connect a headless CMS to any frontend.
POST https://your-site.com/api/cms
Content-Type: application/json
X-CMS-Event: entry.published
X-CMS-Delivery: 3b1c… (same on retries)
X-CMS-Timestamp: 1793300000
X-CMS-Signature: sha256=<hex HMAC-SHA256 of "<timestamp>.<raw body>">
// Reject deliveries older than 5 minutes, compare the signature,
// then refresh the pages that changed.Signed
HMAC-SHA256 over the timestamp and body; the secret is shown once.
Retried
Up to three attempts within seconds, with the same delivery ID.
Logged
See each delivery's status, attempts and response code.
01Three events that matter
entry.published, entry.unpublished and entry.deleted cover what a frontend needs to keep pages fresh. Choose the events per webhook.
02Replay-safe
The timestamp is part of the signature, so your endpoint can reject deliveries older than five minutes. Secrets are stored encrypted.
MCP tools
What your agent can call here
- list_webhooks
- create_webhook
- update_webhook
- delete_webhook
- list_webhook_deliveries
Questions
Where do I see failed deliveries?
In Settings → Webhooks, each webhook lists its deliveries with status, attempts and the response code.
Back to the guide: Connect a headless CMS to any frontend
Keep exploring