Trello webhook payload example (updateCard — card moved)

Trello · event: updateCard (card moved between lists) · content type: application/json

This is a representative sample — fake IDs, real structure. To see a payload with your data, point the provider at a capture URL (button below).

Headers

content-type: application/json
x-trello-webhook: Bg9hOZMxM2iMd2enHXsjgYKry5A=

Body

{
  "action": {
    "id": "68b2f41acd6e040f3c00a917",
    "idMemberCreator": "4fc78a59a885233f4b349bd9",
    "data": {
      "board": {
        "id": "4d5ea62fd76aa1136000000c",
        "name": "Sprint Board"
      },
      "card": {
        "id": "51a79e72dbb7e23c7c003778",
        "idShort": 1458,
        "idList": "5f9d2b1c8e4a2d0b6c003921",
        "name": "Fix flaky webhook test"
      },
      "listBefore": {
        "id": "5f9d2b1c8e4a2d0b6c003920",
        "name": "In Progress"
      },
      "listAfter": {
        "id": "5f9d2b1c8e4a2d0b6c003921",
        "name": "Done"
      },
      "old": {
        "idList": "5f9d2b1c8e4a2d0b6c003920"
      }
    },
    "type": "updateCard",
    "date": "2026-08-30T14:20:31.949Z",
    "memberCreator": {
      "id": "4fc78a59a885233f4b349bd9",
      "fullName": "Ada Perez",
      "initials": "AP",
      "username": "adaperez"
    }
  },
  "model": {
    "id": "4d5ea62fd76aa1136000000c",
    "name": "Sprint Board",
    "closed": false,
    "idOrganization": "4e1452614e4b8698470000e0",
    "url": "https://trello.com/b/nC8QJJoZ/sprint-board"
  },
  "webhook": {
    "id": "68b2f41bd76aa1136003300c",
    "description": "Sprint board sync",
    "idModel": "4d5ea62fd76aa1136000000c",
    "callbackURL": "https://hookden.pages.dev/h/sample-trello",
    "active": true,
    "consecutiveFailures": 0,
    "firstConsecutiveFailDate": null
  }
}

Things that bite people

• This example's signature verifies against the sample secret hookden_trello_sample_app_secret and callbackURL https://hookden.pages.dev/h/sample-trello: X-Trello-Webhook = base64 HMAC-SHA1 over rawBody + callbackURL — the URL is inside the signed content (URL-signing family, like Square/HubSpot), so generic body-only HMAC testers structurally can't verify it. The signature debugger (Trello provider) takes the callbackURL as an extra field; a capture bin with the Trello scheme verifies against the URL the request actually hit. Key = your application's secret (OAuth1.0 secret), not the API key or token.
• The re-serialization trap is in Trello's own docs: their sample verifies JSON.stringify(request.body) — that only matches when your JSON parser round-trips byte-identically (key order, unicode escapes, big numbers). Always HMAC the raw request bytes.
• Creation runs a HEAD request first: the callbackURL must answer a plain HEAD with 200 during webhook creation or you get "400: URL not reachable". Frameworks that only route POST fail here — bins answer HEAD out of the box. An invalid SSL cert also fails creation (plain HTTP is allowed, but delivery SSL is port-443 only).
• Retries: 3, at 30s / 60s / 120s — then the delivery is gone (no replay API). Responding 410 Gone deletes the webhook outright, and a webhook dies silently when its token is revoked or expires — the #1 cause of "Trello webhook stopped firing". Auto-disable needs both 30 days of consecutive failures and 1,000+ failures; any single success resets. The webhook object itself reports consecutiveFailures — poll GET /1/webhooks/{id} to see what Trello sees.
• Every delivery wraps the same trio — action (what happened, see action.type + action.data), model (the watched object), webhook. For a moved card, listBefore/listAfter only appear when the list changed. Loop-safety: pass X-Trello-Client-Identifier on your own API writes and skip actions whose deliveries echo it back. Deliveries come only from 104.192.142.240/28.

Send it yourself

Reproduce this delivery against any endpoint (your handler, a bin, staging):

$ curl -X POST https://your-endpoint.example/hook \
  -H 'content-type: application/json' \
  -H 'x-trello-webhook: Bg9hOZMxM2iMd2enHXsjgYKry5A=' \
 -d '{
  "action": {
    "id": "68b2f41acd6e040f3c00a917",
    "idMemberCreator": "4fc78a59a885233f4b349bd9",
    "data": {
      "board": {
        "id": "4d5ea62fd76aa1136000000c",
        "name": "Sprint Board"
      },
      "card": {
        "id": "51a79e72dbb7e23c7c003778",
        "idShort": 1458,
        "idList": "5f9d2b1c8e4a2d0b6c003921",
        "name": "Fix flaky webhook test"
      },
      "listBefore": {
        "id": "5f9d2b1c8e4a2d0b6c003920",
        "name": "In Progress"
      },
      "listAfter": {
        "id": "5f9d2b1c8e4a2d0b6c003921",
        "name": "Done"
      },
      "old": {
        "idList": "5f9d2b1c8e4a2d0b6c003920"
      }
    },
    "type": "updateCard",
    "date": "2026-08-30T14:20:31.949Z",
    "memberCreator": {
      "id": "4fc78a59a885233f4b349bd9",
      "fullName": "Ada Perez",
      "initials": "AP",
      "username": "adaperez"
    }
  },
  "model": {
    "id": "4d5ea62fd76aa1136000000c",
    "name": "Sprint Board",
    "closed": false,
    "idOrganization": "4e1452614e4b8698470000e0",
    "url": "https://trello.com/b/nC8QJJoZ/sprint-board"
  },
  "webhook": {
    "id": "68b2f41bd76aa1136003300c",
    "description": "Sprint board sync",
    "idModel": "4d5ea62fd76aa1136000000c",
    "callbackURL": "https://hookden.pages.dev/h/sample-trello",
    "active": true,
    "consecutiveFailures": 0,
    "firstConsecutiveFailDate": null
  }
}'

← All payload examples · Signature debugger · Docs