Connect any platform with a webhook

The webhook is Siggmund's generic destination. You provide a URL, Siggmund sends every approved article to it, and your receiver does the publishing — on the platform of your choice, through an automation tool such as n8n, Make or Zapier, or through your own backend.

It requires no plugin, no account to connect and no marketplace approval.

The Siggmund dashboard is currently available in French only. The screen and button names below are quoted as they appear in it, followed by their English meaning.

What the webhook does, and what it does not

The webhook publishes new content. It is a one-way delivery: Siggmund sends you the article and never queries your site in return.

It therefore cannot edit a page that is already live, nor offer an automatic rollback. Both capabilities require a hook on the platform side, which only the WordPress connector provides today.

Step 1 — Declare your URL

From Connexions → Site web / WordPress → Webhook (toutes plateformes) (Connections → Website / WordPress → Webhook, all platforms), enter the URL that will receive the articles. It must be public, served over HTTPS, and answer directly — redirects are refused.

Siggmund then displays a signing secret. Copy it: it is never shown again. If you lose it, the Régénérer le secret (Regenerate the secret) button creates a new one and invalidates the old one immediately.

Step 2 — Receive the request

Siggmund sends a POST request as application/json, with three headers:

The timeout is 10 seconds. Answer with a 2xx as soon as you have accepted the message; if your processing takes long, acknowledge first and work afterwards.

A 3xx response is treated as a failure: Siggmund does not follow redirects.

Step 3 — Verify the signature

The signature is an HMAC-SHA256 of the string <timestamp>.<raw body>, computed with your secret and rendered in hexadecimal.

The raw body is the exact bytes received — not the result of a JSON.parse followed by a JSON.stringify, which would reorder the keys and invalidate the signature.

import crypto from "node:crypto";

function verify(secret, rawBody, headers) {
  const timestamp = headers["x-shoggo-timestamp"];
  const received = headers["x-shoggo-signature"];

  const expected =
    "sha256=" +
    crypto.createHmac("sha256", secret).update(`${timestamp}.${rawBody}`).digest("hex");

  // Constant-time comparison: a `===` leaks the signature character by
  // character to an attacker who measures the response time.
  const a = Buffer.from(expected);
  const b = Buffer.from(received ?? "");
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) return false;

  // The timestamp is part of the signature to prevent replay. Reject what is
  // too old — five minutes is a reasonable value.
  const ageSeconds = Math.abs(Date.now() / 1000 - Number(timestamp));
  return ageSeconds < 300;
}

The timestamp is part of the signed string precisely so that the same request cannot be replayed indefinitely. Verifying the signature without checking its age leaves that door open.

The request body

{
  "version": 1,
  "event": "craft.article.published",
  "deliveryId": "...",
  "clientId": "...",
  "runRef": "...",
  "attemptId": "...",
  "publishedAt": "2026-08-10T09:15:00.000Z",
  "article": {
    "slug": "...",
    "title": "...",
    "status": "...",
    "qcScore": 0,
    "blocks": [],
    "metaTitle": "...",
    "metaDescription": "...",
    "wordCount": 0,
    "thumbImage": null,
    "heroImage": null
  }
}

Two points not to confuse:

• deliveryId is the deduplication key. If you receive the same deliveryId twice, it is the same article: publish it only once.
• attemptId changes on every attempt. It only serves to match Siggmund's logs when you contact support. Never use it for deduplication.

The version field is incremented if the shape of the body changes. Check it if you want to be warned of a contract change rather than discover it in production.

Test your receiver

The connection screen offers an Envoyer un événement de test (Send a test event) button that sends a dummy delivery, signed with your real secret. It is the fastest way to validate your signature check before the first real article.

Disconnecting

The Déconnecter (Disconnect) button deletes the URL and the secret on Siggmund's side, immediately. You can also disconnect unilaterally on your side, by no longer answering on the URL or by changing it: unlike write access, a signing secret grants no rights over your site.

Last updated: August 10, 2026 · First published: August 10, 2026