Until now, finding out whether a post went out meant asking. You called the API, checked the status, and called again later. That works, but it is a poll: you either ask too often and waste requests, or ask too rarely and find out late. Webhooks turn it around. You give sona.to a URL, and sona.to calls you the moment something happens. They are live now on every plan.
There are four events to subscribe to, and they cover the outcomes worth reacting to: a post published, a post failed, a site audit completed, and a site audit failed. You choose which ones each webhook receives, so a Slack notifier can listen only for failures while a reporting pipeline takes everything. The payload uses the same field names the REST API returns, so what you already parse from a GET request works unchanged.
Setting one up takes a minute. Open the API page in your dashboard, paste the URL your tool gave you, tick the events you want, and save. The signing secret appears once at that moment. Copy it then, because it is not shown again.
That secret is how you know a request is real. Every delivery carries a signature header holding a timestamp and an HMAC SHA-256 of that timestamp and the request body, keyed with your secret. Recompute it on your side and compare the two with a constant-time function. Because the timestamp is inside the signed material, a captured request cannot be replayed against you later. Reject anything more than a few minutes old and you are done.
Deliveries do not give up at the first problem. If your endpoint is down or returns an error, the request is retried after 60 seconds, then 5 minutes, then 30 minutes. Every attempt is recorded with its status code and how long it took, so a misbehaving endpoint is something you can look at rather than guess about. An endpoint that keeps failing is switched off automatically, and you can turn it back on once it is fixed.
The obvious place to point one is an automation platform. Zapier, Make and n8n all give you a webhook URL to paste in, and the event arrives as JSON ready to map into whatever comes next: a message in a channel, a row in a spreadsheet, a task in a tracker. Your own server works exactly the same way, with no platform in between.
A note on what sona.to will accept. The destination has to use https, and it has to be a public address. A URL that resolves to a private network is refused, both when you save it and again at delivery time, and redirects are not followed. If you self-host a receiver on a local network, put it behind a public hostname or a tunnel.
Webhooks join the REST API and the MCP server as the third way to drive sona.to from outside the dashboard. The API is for asking, MCP is for being asked by an AI assistant, and webhooks are for being told. Full details, including a signature verification example, are in the API documentation.