Webhook payloads

QACrow delivers events to your endpoint via POST with a JSON body.

Request

POST /your/endpoint HTTP/1.1
Content-Type: application/json
QACrow-Signature: t=1713350000,v1=8f4c2e...
QACrow-Event: run.completed
QACrow-Delivery: dlv_01H...

{
  "id": "evt_01H...",
  "type": "run.completed",
  "createdAt": "2026-04-18T12:34:56Z",
  "data": {
    "run": { /* Run object — see API reference */ }
  }
}

Signature verification

The QACrow-Signature header contains a timestamp t and one or more v1 HMAC-SHA256 hex digests of t + "." + body keyed with your webhook signing secret. Reject requests where the timestamp is older than 5 minutes or the digest doesn't match.

Event types

Event	When it fires
`run.started`	A run transitions to `running`.
`run.completed`	A run reaches a terminal state.
`run.failed`	A run ends with `failed`, `blocked`, or `timed_out`.
`issue.created`	A new issue is recorded for a run.
`issue.critical`	A `critical` severity issue is recorded.
`schedule.triggered`	A scheduled run has been queued.
`credits.low`	Workspace balance fell below the auto-top-up threshold.

Delivery

Endpoints have 10 seconds to respond. Any non-2xx response (or a timeout) triggers an exponential-backoff retry up to 6 times over ~24 hours.