CircleCI workflow-completed webhook payload example

CircleCI · event: workflow-completed · content type: application/json

This is a representative sample — fake IDs, real structure. To see a payload with your data, point the provider at a capture URL (button below).

See it live, not frozen

One click creates a free capture bin with this exact payload already in it — pretty-printed, headers inspectable, replayable to your own endpoint:

Then paste the bin's URL into CircleCI's webhook settings to capture a real delivery. No signup.

Headers

content-type: application/json
user-agent: CircleCI-Webhook/1.0
circleci-event-type: workflow-completed
circleci-signature: v1=7ac938c809001e3fdd1f3126a4f850f234fd7b3f93a7fc31e1825bb8d9023c77

Body

{
  "id": "3888f21b-eaa7-38e3-8f3d-75a63bba8895",
  "type": "workflow-completed",
  "happened_at": "2026-08-30T06:49:34.317Z",
  "webhook": {
    "id": "cf8c4fdd-0587-4da1-b4ca-4846e9640af9",
    "name": "Hookden capture"
  },
  "project": {
    "id": "84996744-a854-4f5e-aea3-04e2851dc1d2",
    "name": "webhook-service",
    "slug": "github/acme/webhook-service"
  },
  "organization": {
    "id": "f22b6566-597d-46d5-ba74-99ef5bb3d85c",
    "name": "acme"
  },
  "workflow": {
    "id": "fda08377-fe7e-46b1-8992-3a7aaecac9c3",
    "name": "build-test-deploy",
    "created_at": "2026-08-30T06:49:03.616Z",
    "stopped_at": "2026-08-30T06:49:34.170Z",
    "url": "https://app.circleci.com/pipelines/github/acme/webhook-service/130/workflows/fda08377-fe7e-46b1-8992-3a7aaecac9c3",
    "status": "success"
  },
  "pipeline": {
    "id": "1285fe1d-d3a6-44fc-8886-8979558254c4",
    "number": 130,
    "created_at": "2026-08-30T06:49:03.544Z",
    "trigger": {
      "type": "webhook"
    },
    "vcs": {
      "provider_name": "github",
      "origin_repository_url": "https://github.com/acme/webhook-service",
      "target_repository_url": "https://github.com/acme/webhook-service",
      "revision": "1dc6aa69429bff4806ad6afe58d3d8f57e25973e",
      "commit": {
        "subject": "fix: verify webhook signatures on raw bytes",
        "body": "",
        "author": {
          "name": "Ada Deveraux",
          "email": "ada@acme.dev"
        },
        "authored_at": "2026-08-30T06:48:53Z",
        "committer": {
          "name": "Ada Deveraux",
          "email": "ada@acme.dev"
        },
        "committed_at": "2026-08-30T06:48:53Z"
      },
      "branch": "main"
    }
  }
}

Things that bite people

This example's signature actually verifies: hex HMAC-SHA256 of the raw body, keyed with the webhook's optional Secret token — here cci_wh_sample_secret_Nk5rW2pQx7. The header is a comma-separated versioned list (v1=<hex>,v2=…); CircleCI's docs say to check only the latest version to prevent downgrade attacks (v1 is currently the only one). Try the signature debugger (CircleCI scheme), or use a capture bin's generic scheme with header circleci-signature — the v1= wrapper is parsed automatically.
Only two event types exist: workflow-completed and job-completed (terminal states only — nothing fires on start). Route on the circleci-event-type header or body type. Workflow status can be success, failed, error, canceled — or unauthorized, which surprises most handlers.
The payload shape depends on how your VCS is connected. GitHub OAuth / Bitbucket Cloud projects get pipeline.vcs (shown here); GitLab, GitHub App and Bitbucket Data Center projects get pipeline.trigger_parameters instead — same event, different place for the commit/branch data. Check Project Settings → Pipelines to see which you have.
Delivery rules (verified vs CircleCI's docs, 2026-08-30): 2xx within 10 seconds or it's a failure; failures retry later; duplicates are possible — dedupe on the top-level id. Payloads are open maps: new fields may appear without notice (not a breaking change), so don't strict-validate.
Limits: 5 webhooks per project, org-admin permissions required to manage them, and "Certificate Validation" should stay on outside testing.

Send it yourself

Reproduce this delivery against any endpoint (your handler, a bin, staging):

$ curl -X POST https://your-endpoint.example/hook \
  -H 'content-type: application/json' \
  -H 'user-agent: CircleCI-Webhook/1.0' \
  -H 'circleci-event-type: workflow-completed' \
  -H 'circleci-signature: v1=7ac938c809001e3fdd1f3126a4f850f234fd7b3f93a7fc31e1825bb8d9023c77' \
 -d '{
  "id": "3888f21b-eaa7-38e3-8f3d-75a63bba8895",
  "type": "workflow-completed",
  "happened_at": "2026-08-30T06:49:34.317Z",
  "webhook": {
    "id": "cf8c4fdd-0587-4da1-b4ca-4846e9640af9",
    "name": "Hookden capture"
  },
  "project": {
    "id": "84996744-a854-4f5e-aea3-04e2851dc1d2",
    "name": "webhook-service",
    "slug": "github/acme/webhook-service"
  },
  "organization": {
    "id": "f22b6566-597d-46d5-ba74-99ef5bb3d85c",
    "name": "acme"
  },
  "workflow": {
    "id": "fda08377-fe7e-46b1-8992-3a7aaecac9c3",
    "name": "build-test-deploy",
    "created_at": "2026-08-30T06:49:03.616Z",
    "stopped_at": "2026-08-30T06:49:34.170Z",
    "url": "https://app.circleci.com/pipelines/github/acme/webhook-service/130/workflows/fda08377-fe7e-46b1-8992-3a7aaecac9c3",
    "status": "success"
  },
  "pipeline": {
    "id": "1285fe1d-d3a6-44fc-8886-8979558254c4",
    "number": 130,
    "created_at": "2026-08-30T06:49:03.544Z",
    "trigger": {
      "type": "webhook"
    },
    "vcs": {
      "provider_name": "github",
      "origin_repository_url": "https://github.com/acme/webhook-service",
      "target_repository_url": "https://github.com/acme/webhook-service",
      "revision": "1dc6aa69429bff4806ad6afe58d3d8f57e25973e",
      "commit": {
        "subject": "fix: verify webhook signatures on raw bytes",
        "body": "",
        "author": {
          "name": "Ada Deveraux",
          "email": "ada@acme.dev"
        },
        "authored_at": "2026-08-30T06:48:53Z",
        "committer": {
          "name": "Ada Deveraux",
          "email": "ada@acme.dev"
        },
        "committed_at": "2026-08-30T06:48:53Z"
      },
      "branch": "main"
    }
  }
}'

← All payload examples · Signature debugger · Docs