Webhooks

A webhook is an HTTPS URL that Quorum calls when something happens in your org. Endpoints belong to the org and are managed by its owners and admins; they keep working when the person who made one leaves.

Create an endpoint

In the dashboard: Org → Webhooks → Add endpoint. Or from the CLI, with workspace:admin (quorum login --admin):

quorum orgs webhooks create --org acme --url https://example.com/hooks/quorum \
  --events 'booking.*,poll.finalized' --description "Zapier"

The response includes the signing secret (whsec_...). It is shown once; store it where your receiver can read it. If you lose it, rotate it.

Choose events by exact type (booking.created), by group (booking.*) or everything (*). The default is everything. The endpoint is pinned to the API version of the request that created it (Versions).

What Quorum will call

• https:// only, on the standard port 443, with no username or password in the URL.
• A public address. Quorum refuses loopback, private, link-local, carrier-grade-NAT, multicast and cloud-metadata addresses, in every spelling (decimal, hex, IPv4-mapped IPv6, and so on), and internal host names (localhost, *.local, *.internal, single-label names). It checks again before every delivery.
• Redirects are never followed. A 3xx is a failed delivery; give Quorum the final URL.
• Quorum waits 10 seconds for an answer and reads at most 2 KB of the response (kept in the delivery log).

An org can have 20 endpoints.

Events

Group	Events
Bookings	booking.created, booking.rescheduled, booking.cancelled, booking.reassigned
Polls	poll.created, poll.responded, poll.finalized
Series	series.week_scheduled, series.paused
Links	link.created, link.updated, link.deleted
Members	member.joined, member.left

Events are about things a team owns (and the org’s members); a person’s own links, polls and bookings are private and never sent. Samples are in the event reference. Payloads carry what an org admin can already see in the dashboard, including a booker’s or respondent’s name and email, and never tokens or calendar details.

Each event is recorded in the same database transaction as the change it reports. If the change fails, nothing is sent; if it commits, the event is not lost, even if Quorum restarts before sending it.

Receive them

Each delivery is a POST with a JSON body and these headers:

Header	Meaning
webhook-id	The event’s id, identical on every retry and redelivery. De-duplicate on it.
webhook-timestamp	Seconds since the epoch when this attempt was made
webhook-signature	One or more v1,<base64> signatures, space-separated
quorum-version	The endpoint’s API version

Verify the signature before you trust the body: Verifying signatures. Answer with any 2xx quickly and do the work afterwards.

Retries

A delivery that doesn’t get a 2xx is retried on the Standard Webhooks schedule: immediately, then after 5 seconds, 5 minutes, 30 minutes, 2 hours, 5 hours, 10 hours and 10 hours, eight tries over about 27 hours. Events can arrive out of order and more than once.

Switching off. An endpoint that hasn’t accepted anything for 5 days, or that answers 410 Gone, is switched off, its outstanding deliveries are abandoned, and the org’s owners and admins get an email. Fix the receiver, turn the endpoint back on, and redeliver what you missed. Turning an endpoint off yourself does the same: what it still owed is abandoned at once, and turning it back on does not resend it.

Quorum sends at most five deliveries to one endpoint at a time, and never to quorumcal.com or workers.dev.

The delivery log

Each endpoint’s page lists its deliveries with every try: when, the status, how long, the error, and the start of the response. From there you can:

• Send a test event. A webhook.test event goes to that endpoint now, whatever it subscribes to and even while it is off, and you see the result at once. A test is a single try.
• Redeliver any delivery. It makes a new delivery of the same event (same webhook-id) with its own retries.
• Turn the endpoint on or off, edit it, or delete it (its log goes with it).

Creating, editing (including the URL), rotating and deleting endpoints are not available over MCP, so an AI agent connected to your account can read endpoints and deliveries but cannot redirect your event stream. Use the dashboard, the CLI or the API.

CLI: orgs webhooks list|get|update|delete|test|deliveries|delivery|redeliver|rotate-secret|events.

Rotate the secret

quorum orgs webhooks rotate-secret --org acme <webhookId> --overlap-hours 24

The new secret is returned once. For the overlap (24 hours by default, up to a week, or 0 for none) every delivery is signed with both secrets: the webhook-signature header carries two signatures, and a receiver that knows either one verifies. Deploy the new secret, then let the old one expire.