Webhooks

Read the API quickstart first. The short version: there is no public Accolade API today, and this page has been corrected to stop describing one. It previously listed a set of webhook event names, an X-Accolade-Signature verification scheme and a 24-hour retry schedule as though you could build against them. Several of those event names do not exist in the product, and nothing here should be treated as an integration contract.

What the screen actually offers

Setup → API & Integrations → Webhooks lists endpoints with their URL, subscribed events, status, last triggered time, success rate and failure count, and has + Add Webhook, Edit, Test and Delete. There is a Webhook Log alongside it.

The delivery settings on the Settings tab are Retry Policy, Retry Delay (seconds), Timeout per delivery (seconds), Include HMAC signature in headers, and an alert on more than three consecutive failures, plus Log Retention and Log Level.

The event names the product uses

These are the events named in the integrations module. They are the vocabulary to use when you talk to us; they are not a promise that a delivery will arrive at your endpoint today:

• nomination.created, nomination.updated
• judge.assigned, judge.scored
• conflict.detected
• sponsor.confirmed
• ticket.sold, ticket.refunded
• payment.received, payment.refunded
• attendee.checked_in
• event.updated

Earlier versions of this page listed nomination.status_changed, judging.score_submitted, winner.locked, guest.checked_in and invoice.paid. Those names are not used by the product. If you have written a handler for them, it will never fire.

Before you build anything

Email support@accolade.live and tell us the endpoint and the events you need, and we will tell you plainly whether delivery is running for your workspace. Do not put a webhook consumer into production on the strength of a documentation page — including this one. Configure the endpoint, press Test, and confirm you received the request before anything depends on it.

If you are receiving deliveries

• Turn on Include HMAC signature in headers and verify the signature at your end. An unauthenticated endpoint that acts on whatever it is sent is a vulnerability, not an integration.
• Use HTTPS. Enforce HTTPS only is on the API & Integrations Settings tab.
• Respond quickly and do the work asynchronously; the per-delivery timeout is measured in seconds.
• Make your handler idempotent. Any retry policy means the same event can arrive twice.
• Watch the failure count on the endpoint row, and keep the consecutive-failure alert on.

What to use meanwhile

For the two things people most often want webhooks for — getting entries out and getting a list in — use Export on the module, Export All Data in Data & Privacy, and Import CSV / Import Guest List. See Exporting and deleting your data.