Frame.io comment.created webhook payload example

Frame.io · event: comment.created · content type: application/json

This is a representative sample — fake IDs, real structure. To see a payload with your data, point the provider at a capture URL (button below).

Headers

content-type: application/json
user-agent: Frame.io V4 API
x-frameio-request-timestamp: 1788518629
x-frameio-signature: v0=f543842cc443b98aeacf7acc6d68168d565a964935a7848014da182d360d7986

Body

{
  "account": {
    "id": "6f70f1bd-7e89-4a7e-b4d3-7e576585a181"
  },
  "project": {
    "id": "7e46e495-4444-4555-8649-bee4d391a997"
  },
  "resource": {
    "id": "a91d2c66-31f8-4b0c-9e5d-2f8c47a3b510",
    "type": "comment"
  },
  "type": "comment.created",
  "user": {
    "id": "56556a3f-859f-4b38-b6c6-e8625b5da8a5"
  },
  "workspace": {
    "id": "378fcbf7-6f88-4224-8139-6a743ed940b2"
  }
}

Things that bite people

• This example's signature actually verifies: paste the body, the timestamp, the signature and the secret hookden-frameio-sample-signing-secret into the signature debugger (Frame.io scheme), or set the Frame.io scheme on a capture bin for live ✓/✗ badges. Wire format and traps (500-second sample-code freshness window, latin-1, non-constant-time compare) are covered on the file.ready page — same signing secret rules: non-configurable, returned only in the create-webhook response.
• The payload contains no comment text. resource is a thin pointer (id + type: "comment") — you must GET the comment via the V4 API (Adobe-Console OAuth) to read the message, author, timestamp-on-media, or annotations. The account / workspace / project / user ids exist so you can route/filter before spending that API call — note user.id is who triggered the event, which for comment.created is the commenter.
• Replies fire comment.created too — the docs define it as "a new Comment or Reply has been created", and there is no separate reply event. If your integration posts notifications, fetch the comment and check its parent to avoid double-notifying threads. The other comment events: comment.updated, comment.deleted, and comment.completed / comment.uncompleted for the task-checkbox state — completion is its own event pair, not an updated.
• Webhooks are workspace-wide. Every project in the workspace fires your endpoint — a busy review workspace generates a lot of comment.created. Frame.io's own advice is to subscribe to few events per webhook and split endpoints by purpose; filter on project.id early. Retries: 5 total attempts, exponential from 15s with jitter; non-2xx or a response slower than 5 seconds counts as failure.
• C2C / review integrations: comment events are the backbone of "sync Frame.io notes into your NLE / task tracker" tools. While building one, point the webhook at a capture bin first — you'll see the exact envelope above (and can relay to localhost with byte-identical bodies, so the signature still verifies).

Send it yourself

Reproduce this delivery against any endpoint (your handler, a bin, staging):

$ curl -X POST https://your-endpoint.example/hook \
  -H 'content-type: application/json' \
  -H 'user-agent: Frame.io V4 API' \
  -H 'x-frameio-request-timestamp: 1788518629' \
  -H 'x-frameio-signature: v0=f543842cc443b98aeacf7acc6d68168d565a964935a7848014da182d360d7986' \
 -d '{
  "account": {
    "id": "6f70f1bd-7e89-4a7e-b4d3-7e576585a181"
  },
  "project": {
    "id": "7e46e495-4444-4555-8649-bee4d391a997"
  },
  "resource": {
    "id": "a91d2c66-31f8-4b0c-9e5d-2f8c47a3b510",
    "type": "comment"
  },
  "type": "comment.created",
  "user": {
    "id": "56556a3f-859f-4b38-b6c6-e8625b5da8a5"
  },
  "workspace": {
    "id": "378fcbf7-6f88-4224-8139-6a743ed940b2"
  }
}'

← All payload examples · Signature debugger · Docs