Asana webhook payload example (task changed)

Asana · event: task changed + story added (batched events) · content type: application/json

This is a representative sample — fake IDs, real structure. To see a payload with your data, point the provider at a capture URL (button below).

Headers

content-type: application/json
x-hook-signature: e91b214ea1521bf0429612df7fa05cfcbf1c1a79728c974eeacd83d9cdf6ae9e

Body

{
  "events": [
    {
      "user": {
        "gid": "1201234567890123",
        "resource_type": "user"
      },
      "created_at": "2026-08-30T12:10:04.483Z",
      "action": "changed",
      "parent": null,
      "change": {
        "field": "assignee",
        "action": "changed",
        "new_value": {
          "gid": "1201234567890123",
          "resource_type": "user"
        }
      },
      "resource": {
        "gid": "1209876543210987",
        "resource_type": "task"
      }
    },
    {
      "user": {
        "gid": "1201234567890123",
        "resource_type": "user"
      },
      "created_at": "2026-08-30T12:10:05.121Z",
      "action": "added",
      "parent": {
        "gid": "1209876543210987",
        "resource_type": "task"
      },
      "resource": {
        "gid": "1209876543211042",
        "resource_type": "story"
      }
    }
  ]
}

Things that bite people

• The handshake happens over headers, not the body. When you create a webhook (POST /webhooks), Asana immediately POSTs to your target URL with an X-Hook-Secret request header; your server must echo that exact value back as a response header (with 200/204) before the create call will return 201. A common failure: your server can't handle the incoming handshake while its own create request is still pending (it needs to process both at once). A capture bin passes this with zero code — add the response header line X-Hook-Secret: {{header.x-hook-secret}} in bin settings. That secret is your signing key for every later delivery, and it's never shown again (fetching the webhook object won't return it).
• This example's signature actually verifies: X-Hook-Signature is bare hex HMAC-SHA256 of the raw body, key = the X-Hook-Secret from the handshake — here the sample 8f2a5c1e9b7d4a63f0c8e21b5d9f7a3c6e4b0d8a2f5c7e9b1d3f6a8c0e2b4d5f. Paste body + header into the signature debugger (generic scheme), or set the same secret on a capture bin (generic scheme, header x-hook-signature) for live ✓/✗ badges.
• Events are compact pointers, batched, and sometimes empty. The body is one events array; each event has user / resource / action (added, changed, removed, deleted, undeleted) / parent / created_at — no task names, no field values beyond gid pointers. For changed events, look at change.field and change.action; new_value / added_value / removed_value carry only gid+resource_type in webhook deliveries. Fetch current state from the API — and note user can be null for system-generated events. An empty events array is a heartbeat, not a bug.
• Answer heartbeats or lose the webhook. Asana delivers a heartbeat every 8 hours to update last_success_at. No successful response for 24 hours (heartbeats included) = the webhook is silently deleted, not paused — the #1 cause of "my Asana webhook stopped firing". Deliveries retry with exponential backoff within that window; you have 10 seconds to respond. Also: responding 410 Gone tells Asana to delete the webhook on purpose — don't emit 410s from a misconfigured proxy.
• Delivery is at-most-once with no replay, so Asana itself recommends a fallback polling sync if you can't tolerate missing events. Events "bubble up" (story → task → project), and webhooks on team/workspace/portfolio/goal require explicit filters. Watch for consolidation: rapid edits may merge stories, so you can receive an event for a story that no longer exists — and per-keystroke events on text fields that look like duplicates but aren't.
• Debugging tip: the webhook object records last_failure_at and last_failure_content (your endpoint's actual error response) plus delivery_retry_count — GET /webhooks/{gid} shows you what Asana saw when it last tried.

Send it yourself

Reproduce this delivery against any endpoint (your handler, a bin, staging):

$ curl -X POST https://your-endpoint.example/hook \
  -H 'content-type: application/json' \
  -H 'x-hook-signature: e91b214ea1521bf0429612df7fa05cfcbf1c1a79728c974eeacd83d9cdf6ae9e' \
 -d '{
  "events": [
    {
      "user": {
        "gid": "1201234567890123",
        "resource_type": "user"
      },
      "created_at": "2026-08-30T12:10:04.483Z",
      "action": "changed",
      "parent": null,
      "change": {
        "field": "assignee",
        "action": "changed",
        "new_value": {
          "gid": "1201234567890123",
          "resource_type": "user"
        }
      },
      "resource": {
        "gid": "1209876543210987",
        "resource_type": "task"
      }
    },
    {
      "user": {
        "gid": "1201234567890123",
        "resource_type": "user"
      },
      "created_at": "2026-08-30T12:10:05.121Z",
      "action": "added",
      "parent": {
        "gid": "1209876543210987",
        "resource_type": "task"
      },
      "resource": {
        "gid": "1209876543211042",
        "resource_type": "story"
      }
    }
  ]
}'

← All payload examples · Related guide · Signature debugger · Docs