A webhook is an address in your system that PIM sends a message to when something happens — a product changed or an import finished, for example.

Open **Settings → Webhooks**. **Administrators** and **Owners** can add and change them.

## Creating a webhook

1. Click **Add webhook**.
2. Enter the **Address** (must be `https://`).
3. Tick the **Events** your system really needs.
4. Click **Create webhook**.
5. The webhook page opens with the **Signing key**. **Copy it straight away** (button next to it) — it won't be shown again.

A disabled webhook (**Active** unticked) stays saved, but no messages are sent.

## Events

**Products:** product created, changed, archived, published to a store, added to the assortment, products merged / merge undone, product unlinked, variant linked to / unlinked from its parent.

**Images and files:** image or file uploaded, images or files changed.

**Texts and properties:** translation completed, enrichment completed, properties merged / merge undone.

**Suppliers:** import completed, offer no longer available, supplier attached / detached.

## Verifying the signature

Every request carries the header:

```
X-Ecompim-Signature: t=<unix time>,v1=<signature>
```

`v1` = `HMAC-SHA256(signing key, t + "." + request body)`, in hex. Verify the signature and reject old requests (for example when `t` is older than 5 minutes).

PIM generates the signing key automatically and shows it **only once**; later only its last 4 characters are visible. If the key is lost or compromised, click **Change key** and confirm — the old key stops working immediately and the new one is shown once. Remember to put it into your system.

## If your system doesn't respond

PIM tries **4 times**: immediately, after 1 minute, after 5 minutes and after 30 minutes. After that the event isn't sent again.

> To make sure you don't miss anything, also use the **`/api/v1/events`** API endpoint — it holds every event and can be read at any time.