Events guide

Notification callbacks

A mention does not send email. Hosted can POST comments.user_mentioned to an HTTPS endpoint you register on the dashboard. BYO returns events from your adapter. In both cases the payload is ids.

{
  "event": "comments.user_mentioned",
  "workspaceId": "ws_…",
  "productId": "comments",
  "timestamp": "2026-09-26T12:00:00.000Z",
  "data": {
    "eventId": "cme_…",
    "schemaVersion": 1,
    "appId": "cma_demo",
    "environment": "test",
    "tenantKey": "acme",
    "resourceType": "task",
    "resourceId": "task_1842",
    "threadId": "thr_…",
    "commentId": "cmt_…",
    "actorId": "user_ada",
    "mentionedUserId": "user_kai",
    "occurredAt": "2026-09-26T12:00:00.000Z"
  }
}

Verify X-Bootstrapware-Signature (HMAC-SHA256 hex of the raw body, using the endpoint secret) on Hosted deliveries. Store eventId and skip duplicates. The POST may be retried once after 400 ms, and a failed delivery is not replayed forever. There is no body to quote in an email. If you email Kai, your server checks that Kai may read task_1842 in tenant acme, then loads the comment from your store or from an authorized Hosted read.

Self-mentions and replayed mutations do not emit a new mention event. Removing a mention emits nothing. Widget subscribe is a live refresh of ids for the open resource. It is not a notification inbox and it is not presence.

Signing and event names: webhooks.

Related: Mentions · Privacy by mode · Safe mentions