post_created

This event fires every time a post is successfully published, whether on the community feed or inside a specific group. Use it to index content in external systems, feed search engines, or trigger additional moderation.

The internal event name (used when subscribing webhooks in the Console) is post_created.

Point a listener at your URL with EventName: "post_created". Auth, secret and verification in Subscribing and verifying webhooks.

curl -X POST \
  https://apis.cativalab.digital/tenant/api/v2/admin/integration/01HQ0ABCDEF1234567890XYZ/webhooks \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "EventName": "post_created",
    "Url": "https://myapp.com/webhooks/cativa",
    "IsActive": true
  }'

When it fires

User publishes a post on the community’s main feed
User publishes a post inside a group
You create a post via API

When it does NOT fire

Edit of an existing post
Comment on a post (that’s a separate event)
Reaction (like) on a post
Post rejected by automated moderation before being published
User not found while enriching the payload (delivery is skipped)
Creation fails (validation, locked group, banned user, etc.)

Payload

The payload is serialized in PascalCase and delivered in the body of the POST with Content-Type: application/json:

{
  "CustomerId": "01HQ0ABCDEF1234567890XYZ",
  "PostId": "01HQ8POST1234567890ABCDEFG",
  "GroupId": "01HQ2GROUP1234567890XYZAB",
  "User": {
    "Id": "01HQ7Z3X4Y5Z6A7B8C9D0E1F2G",
    "Email": "mary@example.com",
    "FirstName": "Mary",
    "LastName": "Smith",
    "DisplayName": "Mary Smith",
    "Username": "mary.smith",
    "PhoneNumber": "+15551234567",
    "CreatedAt": "2026-04-12T14:32:01Z",
    "BadgeId": "01HQ4ABCDEF1234567890XYZ",
    "Badges": [
      "01HQ4ABCDEF1234567890XYZ"
    ]
  },
  "Content": "Just finished module 3 of the course — highly recommend!",
  "ImageUrl": "https://cdn.cativalab.digital/posts/01HQ8POST.../original.jpg",
  "CreatedAt": "2026-05-08T14:32:01Z"
}

Payload fields

Field	Type	Description
`CustomerId`	GUID	ID of the tenant that emitted the event. Use it to route when your endpoint receives webhooks from multiple tenants.
`PostId`	GUID	ID of the newly created post.
`GroupId`	GUID \| null	ID of the group where the post was published. When `null`, the post was published on the community’s main feed (outside of any group).
`User.Id`	GUID	ID of the post author.
`User.Email`	string	Author email.
`User.FirstName`	string	First name.
`User.LastName`	string	Last name.
`User.DisplayName`	string	Display name.
`User.Username`	string	Username.
`User.PhoneNumber`	string	Phone, when provided.
`User.CreatedAt`	ISO 8601	When the author was created in the tenant.
`User.BadgeId`	GUID \| null	Author’s primary badge at the time of the post.
`User.Badges`	GUID[]	Full list of badges held by the author at the time of the post.
`Content`	string \| null	Post text. May be `null` for posts that contain only media (image or video).
`ImageUrl`	string \| null	URL of the first image attached to the post (original resolution). `null` when the post has no images. Posts with video or other media types do not populate this field.
`CreatedAt`	ISO 8601	Moment when the post was created.

Request headers

Header	Description
`X-Cativa-Signature`	HMAC-SHA256 signature of the delivery, in the format `t=<unixTs>,v1=<hex>`. Verify it before processing the event.
`X-Cativa-Idempotency-Key`	Canonical deduplication key. Identical across all retries of the same delivery.
`X-Cativa-Execution-Id`	Unique ID of this event. Stable across retries — use it as your idempotency key.
`X-Cativa-Automation-Id`	ID of the listener configured in the Console (same value across all deliveries from the same subscription).

The full explanation of how to verify X-Cativa-Signature, handle retries and ensure idempotency (with examples in Node, Python, Go and C#) lives in Subscribing and verifying webhooks.

Use cases

Index in external search — push PostId + Content into an index (Algolia, Elasticsearch, Meilisearch) for cross-group search inside your own app.
Notify a moderation channel — forward posts in sensitive groups to an internal channel (Slack, Discord) where the moderation team reviews them in parallel.
Sync to newsletter / social media — take Content + ImageUrl and automatically republish on LinkedIn, Twitter, or in a newsletter, attributing authorship via User.DisplayName.

Reacting to the event

After verifying the signature, index the post in an external search engine for cross-group search. PostId doubles as the stable index ID (and the idempotency key):

async function onPostCreated(event) {
  const { PostId, GroupId, Content, ImageUrl, User } = event;

  await searchIndex.upsert({
    id: PostId,
    groupId: GroupId,       // null = main feed
    text: Content ?? '',    // null on media-only posts
    image: ImageUrl,        // null when there's no image
    author: User.DisplayName,
  });
}

user_joined_group

Fired when a user joins a group — useful complement to understand the context of who is posting.

user_received_badge

Fired when the user earns a badge — useful to correlate engagement (post) with permission.

Subscribing to webhooks

How to register listeners, verify HMAC and handle retries.

Webhooks (overview)

Why webhooks, delivery guarantees and payload format.

Get Started

Concepts

Guides

Webhooks

Changelog

When it fires

When it does NOT fire

Payload

Payload fields

Request headers

Use cases

Reacting to the event

user_joined_group

user_received_badge

Subscribing to webhooks

Webhooks (overview)

​Subscribe to this event

​When it fires

​When it does NOT fire

​Payload

​Payload fields

​Request headers

​Use cases

​Reacting to the event

​Related events

user_joined_group

user_received_badge

Subscribing to webhooks

Webhooks (overview)

Subscribe to this event

When it fires

When it does NOT fire

Payload

Payload fields

Request headers

Use cases

Reacting to the event

Related events