Developers
Webhooks
Every notification your account produces can be sent straight to your own systems as a signed JSON POST — so what happens on your hosting can start a workflow anywhere else.
What you can connect it to
A webhook is an ordinary HTTPS request, so anything that can receive one can act on it. You do not need us to build an integration for your tool.
Automation platforms
Point a webhook at a workflow in n8n, Make, Zapier, Pipedream, Activepieces and every event becomes a trigger — post to a channel, open a ticket, update a spreadsheet, call another API. Self-hosted platforms work exactly the same way, as long as the endpoint is reachable over HTTPS.
CRMs and helpdesks
Send billing and account events to HubSpot, Pipedrive, Salesforce, or to any helpdesk or CRM with an inbound webhook, so a customer record reflects what their hosting is doing without anyone copying it across.
Anything else that listens
Slack, Discord, Google Sheets, Airtable, Notion, your own monitoring, a data warehouse, or a small script you wrote. If it can accept an HTTPS POST and read JSON, it can receive these.
What gets sent
You choose which categories go to which destination — and you can connect several, so billing can go one place and site alerts another. Everything is on by default.
Billing and payments
Invoices issued and paid, payments that failed, cards about to expire, renewals and cancellations.
Sites and security
Provisioning finished, a site suspended, malware found, backups and certificate changes.
Support and domains
Tickets opened and escalated, domain transfers, renewals and DNS changes.
Proving a request came from us
Every request is signed with a secret only you and we hold. Check the signature before you act on the body — these headers arrive with each delivery:
X-Zinn-Signature: sha256=<hmac of `timestamp.body`>
X-Zinn-Timestamp: unix seconds
X-Zinn-Delivery: stable id for this delivery
X-Zinn-Event: invoice.paidThe timestamp is signed together with the body rather than sent beside it, so a request someone captured cannot be replayed at you later. Reject anything older than a few minutes.
Your signing secret is shown once, when you add the webhook. We cannot show it again — if you lose it, remove the destination and add it back.
Setting one up
- In your dashboard, open Notifications and add a destination of type Webhook.
- Give it your HTTPS endpoint and copy the signing secret we show you.
- Press Test. We send a real request in the same shape as a live one, so you can build against it before anything real happens.
- Choose which categories that destination should receive. New kinds of notification are switched on automatically.
You can add as many destinations as you like, mix webhooks with email, Slack and Telegram, and give each one a different set of categories.
Prefer to call us instead?
Webhooks tell you when something happened. The API is how you make something happen — every operation the dashboard performs is available to you.