Webhooks
Linear provides webhooks which allow you to receive HTTP push notifications whenever data is created or updated. This allows you to build integrations on top of Linear. You could trigger CI builds, perform calculations on issue data, or send messages on specific conditions – you name it.
Webhooks are specific to an Organization
, but you can configure webhooks to provide updates from all public teams, or a single team to satisfy the needs of each team in your organization.
Please visit your application's settings to configure webhooks.
Additionally, OAuth applications can configure webhook settings. Once those settings are configured, each time a new organization authorizes the given application, a webhook will be created for that organization that posts to the provided webhook URL, as described below. If your application is de-authorized from an organization the OAuthApp revoked event will be sent.
Only workspace admins, or OAuth applications with the admin
scope, can create or read webhooks.
What we call "data change webhooks" are currently supported for the following models:
Issues
Issue attachments
- DocumentationIssue comments
Issue labels
Comment reactions
Projects
Project updates
Cycles
Other webhooks are provided for convenience:
Issue SLA
- DocumentationOAuthApp revoked
- Documentation
How does a Webhook work?
A Webhook push is simply a HTTP POST
request, sent to the URL of your choosing. The push is automatically triggered by Linear when data updates. For an example of what data a payload contains, see The Webhook Payload.
Your webhook consumer is a simple HTTP endpoint. It must satisfy the following conditions:
It's available in a publicly accessible HTTPS, non-localhost URL
It will respond to the Linear Webhook push (HTTP POST request) with a
HTTP 200
("OK") response
If a delivery fails (i.e. server unavailable, takes longer than 5s to respond, or responds with a non-200 HTTP status code), the push will be retried a maximum of 3 times. A backoff delay is used: the attempt will be retried after 1 minute, 1 hour, and finally after 6 hours. If the webhook URL continues to be unresponsive the webhook might be disabled by Linear, and must be re-enabled again manually.
To make sure a Webhook POST is truly created by Linear, you can check the request to originates from one of the following IPs: 35.231.147.226, 35.243.134.228, 34.140.253.14, or 34.38.87.206.
For additional information on Webhooks, there are a number of good resources:
requestbin.com is a great tool for testing webhooks
Getting started with Linear Webhooks
You will first need to create a Webhook endpoint ("consumer") to be called by the Linear Webhook agent. This can be a simple HTTP server you deploy yourself, or a URL endpoint configured by a service such as Zapier (or for testing purposes, RequestBin).
Once your consumer is ready to receive updates, you can enable it for your Linear team. Webhooks can be enabled in Linear both via the Team Settings UI.
Creating a simple Webhook consumer
You might consider using something like Netlify Functions, Vercel Functions, or Cloudflare Workers, which provide a straightforward way of deploying simple HTTP(S) endpoints.
Deploying a simple webhook consumer on Netlify might look something like this:
Netlify has also created a template to deploy a webhook in a single click:
Configuring with the Settings UI
The easiest way to configure a Webhook is via API Settings. Open Settings and find "API".
Click on "New webhook", and specify the URL in which you have an endpoint ready to receive HTTP POST requests. Label is used to identify webhooks and describe their purpose.
Your newly created webhook will be listed and is ready to be used. Your defined URL of http://example.com/webhooks/linear-updates
will now get notified of any updates for your chosen models.
Creating a new Webhook
To create a new Webhook via the API, you can create a new Webhook with by calling a webhookCreate
mutation with the teamId
(or allPublicTeams: true
) and url
of your webhook, and the preferred resourceTypes
([Comment, Issue, IssueLabel, Project, Cycle, Reaction]
):
The server should respond with a success
flag, along the id
of your newly created webhook:
That's it! Your webhook is now ready to use and enabled by default. You can try it out e.g. by commenting on an Issue on your team, or maybe creating a new Issue.
Querying existing webhooks
Your webhooks belong to an Organization. You can either query all webhooks in your organization, or find them via their respective teams.
Querying all webhooks in your organization (the results are paginated, so you will need to include the nodes
property.):
Querying webhooks via their associated teams:
Deleting a webhook
Deleting a webhook is done with the webhookDelete
mutation, by supplying the id
of the webhook in question:
The Webhook Payload
The webhook HTTP payload will include information both in its HTTP headers and its request body.
The format of the payload body reflects that of the corresponding GraphQL entity. To get a hang of the data contained in the various objects, feel free to play around with GraphQL queries against Linear's API.
The payload will be sent with the following HTTP headers:
Where the custom headers include:
Name | Description |
| An UUID (v4) uniquely identifying this payload. |
| The Entity type which triggered this event: |
| HMAC signature of the webhook payload |
Data change events payload
These fields are present on all data change events.
Field | Description |
| The type of the action that took place: |
| The type of entity that was targeted by the action. |
| The date and time that the action took place. |
| The serialized value of the subject entity. |
| URL where you can open up the subject entity. |
| For |
| UNIX timestamp when the webhook was sent. |
| ID uniquely identifying this webhook. |
For example:
Other events payload
These fields will be present on all other events as well.
Field | Description |
| The type of the action that took place. Specific to the event stream. For Issue SLA this is for example one of |
| The type of entity that was targeted by the action. |
| The date and time that the action took place. |
| URL where you can open up the subject entity. |
| For |
| UNIX timestamp when the webhook was sent. |
| ID uniquely identifying this webhook. |
Issue SLA fields
These fields are present on Issue SLA events.
Field | Description |
| The serialized value of the issue. |
OAuthApp revoked fields
This webhook is specific to OAuth applications and is called when your app is revoked from an organization. The will be type
set to OAuthApp
and action
to revoked
.
Field | Description |
| Id of OAuth App that was revoked. |
| Organization from which OAuth App was revoked. |
Securing webhooks
We support securing webhooks through content hashing with a signature. SHA256 HMAC signature is calculated of the content and delivered in Linear-Signature
header which can used for comparison. Content body also includes a field webhookTimestamp
with UNIX timestamp of the time when webhook was sent. It's recommended you verify that it's within a minute of the time your system sees it to prevent replay attacks.
To verify the webhook, calculate the signature from request body using the webhook secret available in developer settings. It's recommended to use raw request body content for the hashing as using JSON parsing might change it.
In addition to verifying webhook, it's recommended to validate the sender IP addresses. See section above for the list.
Last updated