Webhooks

Webhooks let FeedSync notify your own systems in real time whenever your listings change. Each webhook belongs to a site and sends an HTTP POST to a URL you control.

What is a webhook?

When a listing event occurs, FeedSync sends a JSON POST to your configured URL. Your server receives it and can do anything — update a database, refresh a cache, trigger a workflow. (When you connect a WordPress site, a webhook is created for you automatically — see WordPress.)

Adding a webhook

1. Open a site on the Sites tab.
2. Add a webhook and enter the destination URL (must be publicly reachable).
3. A signing secret is generated — you'll use it to verify requests.
4. Optionally limit the webhook to certain listing types.

Event types

Event	Fired when
listing.created	A listing is processed for the first time.
listing.updated	An existing listing's data changes.
listing.status_changed	A listing's status changes (e.g. current → sold).
listing.images	A listing's images/media change.
listing.deleted	A listing is deleted.
system.ping	A test event you can trigger to verify connectivity.

Payload

FeedSync sends a JSON body describing the event and the affected listing, for example:

{
  "event": "listing.status_changed",
  "listing": {
    "feedsync_unique_id": "CPN2540-1P1329",
    "status": "sold",
    "under_offer": false,
    "type": "residential",
    "full_address": "22 Brisbane Street, Bondi Junction NSW 2022",
    "price": 3900000,
    "bedrooms": 4,
    "bathrooms": 2,
    "mod_time": "2024-06-15T09:30:00"
  }
}

Verifying the signature

Every request includes an X-Webhook-Signature header — an HMAC‑SHA256 of the raw request body, keyed with your webhook secret, in the form sha256=<hash>. Verify it before trusting the payload:

$payload   = file_get_contents('php://input');
$expected  = 'sha256=' . hash_hmac('sha256', $payload, $yourWebhookSecret);
$received  = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';

if (!hash_equals($expected, $received)) {
    http_response_code(401);
    exit;
}

tip

Compute the HMAC over the exact raw body you received — don't re-encode the JSON first, or the signature won't match.

Delivery & retries

• Return a 2xx quickly to acknowledge receipt.
• If your endpoint errors or times out, FeedSync retries (with a delay you can configure).
• After repeated consecutive failures a webhook is paused automatically, and after continued failures it's disabled, so a dead endpoint doesn't pile up. Fix the endpoint and re-enable the webhook to resume.

Testing

Send a system.ping, or point a webhook at a tool like webhook.site to inspect exactly what FeedSync delivers.