Webhooks

​

Overview

​

Setup

​

Payload

{
  "event": "note.created",
  "trigger": "auto",
  "noteId": "1725000000000123",
  "title": "Weekly sync",
  "createdAt": "2026-09-03T10:00:00.000Z",
  "updatedAt": "2026-09-03T11:30:00.000Z",
  "durationSeconds": 1830,
  "template": "Meeting Notes",
  "templateId": "meeting-notes",
  "hasTranscript": true,
  "hasSummary": true,
  "transcript": "Speaker 1: ...\nSpeaker 2: ...",
  "summary": "The AI-generated meeting summary",
  "tags": ["Sales", "Follow-up"]
}

• event: what produced this delivery. note.created when a summary finishes generating, note.manual_send for the Send to webhook action on a note
• trigger: auto or manual, the short form of event. Also sent as the X-Vowen-Event header
• noteId: the note’s identifier, as a string. It is the same on every device once cloud sync has run, and it never changes, so use it to connect an automatic delivery with any later manual send of the same note. X-Vowen-Delivery-Id identifies one delivery; noteId identifies the note
• title: the note title at the time of sending
• createdAt: when the note was created, ISO 8601
• updatedAt: when the note record last changed, ISO 8601. null for notes that have not been edited since updating to the version that introduced it
• durationSeconds: length of the recording. null when unknown, for example imported text
• template / templateId: the summary template’s display name and its stored id
• hasTranscript / hasSummary: whether the matching text field is non-empty, so you can branch without inspecting the text itself
• transcript: the full transcript, with any speaker names you assigned folded into the Speaker N: prefixes
• summary: the summary text, with Vowen’s internal citation markers stripped out
• tags: resolved tag names, not internal IDs. Always present; [] when the note has no tags

​

Slack and Discord formatting

​

Custom headers

​

Send automatically

• On (default): the webhook fires every time a summary is generated
• Off: nothing fires automatically. Open a note and click Send to webhook to send it by hand

​

Verifying deliveries with HMAC signing

​

Headers

​

What is signed

<X-Vowen-Timestamp>.<raw request body>

​

Verification example

const crypto = require('crypto');

const TOLERANCE_SECONDS = 300;

function verifyVowenWebhook(rawBody, headers, secret) {
  const signature = headers['x-vowen-signature'];
  const timestamp = headers['x-vowen-timestamp'];
  if (!signature || !timestamp) return false;

  // Reject anything outside the replay window.
  const age = Math.abs(Math.floor(Date.now() / 1000) - Number(timestamp));
  if (!Number.isFinite(age) || age > TOLERANCE_SECONDS) return false;

  const digest = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`, 'utf8')
    .digest('hex');
  const expected = `sha256=${digest}`;

  if (signature.length !== expected.length) return false;
  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}

​

Delivery logs

• The last 25 deliveries are retained; older entries drop off automatically
• Each row shows Time, Status, Trigger (auto or manual), Note, and Duration
• Expanding a row reveals the endpoint, the payload format (json, slack, or discord), request headers, request body, and response body
• Headers named Authorization, Cookie, or Proxy-Authorization, or whose name contains key, token, secret, password, or auth, are stored as ***, so a custom auth header you added is never written to the log file
• Request and response bodies are truncated at 2048 characters, with a note showing how many were dropped
• Refresh re-reads the log; Clear logs empties it

​

Error handling