Checklist webhooks that tell your systems the moment it happens.
Choose an event, such as a task completed or a checklist finished, and an address. CheckFlow posts the details there as JSON, signs every delivery, tries again if your system is down and keeps 30 days of history you can replay.
14-day free trialNo credit cardUnlimited free guests
Headers
CF-Event: task_completed
CF-Delivery-Id: 5b1e0c7a-…
CF-Signature: t=1789465212,v1=5b29f9f5…Body (shortened)
{
"taskName": "Approve invoice",
"taskCompletedByName": "Sarah Chen",
"taskCompletedDateTime": "2026-09-15T09:40:12+00:00",
"fields": [{ "drop_down_decision": "Approved" }],
"checklist": { "checklistName": "Invoice Review INV-2041" },
"template": { "templateName": "Invoice Review", "templateVersion": 4 }
}Last updated
A webhook tells your own system when something happens in CheckFlow. You subscribe an https address to one of nine events: a checklist started or completed, a task completed or assigned, a comment, a file upload, or a Data Set record added, changed or deleted. CheckFlow posts JSON there, signed with your secret. Administrators set them up on the Webhooks tab or through the API.
Your other systems stay in step without anyone copying data across.
No polling
Your system hears about a completed task or a finished checklist straight away, instead of asking the API every few minutes.
Proof it came from CheckFlow
Every delivery is signed with a secret only you and CheckFlow hold, with a timestamp so an old delivery can’t be sent again.
Nothing lost in an outage
Failed deliveries are tried again for a few hours, and 30 days of history let you replay anything your system missed.
Events
Nine events, narrowed to what you need
Most events can be narrowed to one template, one task or one upload field, so your system receives only what it acts on. The three Data Set events always cover the whole workspace.
| Event | Fires when | Can cover |
|---|---|---|
| new_checklist | A checklist is started from a template | One template |
| checklist_completed | A checklist becomes complete | One template, or the whole workspace |
| task_completed | A task is completed, in the app, by API or over MCP | One task, one template, or the whole workspace |
| task_assigned | A task is given to someone who did not have it | One task, one template, or the whole workspace |
| comment_created | Someone comments on a task | One task, or the whole workspace |
| file_uploaded | A file is uploaded to a File Upload field | One field |
| data_set.record.created | A Data Set record is added | The whole workspace |
| data_set.record.updated | A Data Set record’s values change | The whole workspace |
| data_set.record.deleted | A Data Set record is deleted | The whole workspace |
A task scope uses the template’s task, so it fires for that step on every checklist started from the template. The full payload for each event is in the webhook events reference.
No code to set up
Add a webhook on the Webhooks tab
An Administrator opens the Webhooks tab of Team Management and clicks Add webhook. Choose the event in When, what it covers in For, and the address in Send to. CheckFlow then shows the signing secret once: copy it into the receiving system before you close the dialog.
The same tab lists every webhook in the workspace, whether it was added here, through the API or by a Zap, with its status and delivery history. From a webhook’s menu you can change its address, pause it, give it a new signing secret or delete it. Other Administrators are told when one is added or deleted.
- Addresses must be https and on the public internet
- To change the event or what it covers, delete it and add a new one
- Developers can do all of this with the Webhooks API instead
Reliable delivery
Signed, retried, and replayable for 30 days
Each delivery carries CF-Signature: a timestamp and an HMAC-SHA256 of the timestamp and the raw body, keyed with your secret. Check it before you trust anything else in the request. CF-Delivery-Id stays the same on every retry and replay, so your system can ignore a delivery it has already handled.
Answer with any 2xx status within 30 seconds. Anything else counts as a failure, and the delivery is tried again: five attempts in all over a few hours. If a webhook fails ten events in a row, CheckFlow switches it off and says why on the Webhooks tab. Fix the receiver, turn it back on, and replay what it missed from the delivery history.
- Deliveries are kept for 30 days, with the response your system gave
- A new signing secret works alongside the old one for 24 hours
- Read the event from the CF-Event header: four payloads don’t name it
Use cases
Five webhooks worth adding
Each one pairs a real event with a template from the library.
Tell the HR system a new starter is on the way
new_checklist on Employee Onboarding posts the new checklist, its parameters and who started it to your HR system.
Employee onboarding templateRelease a payment when the approval is done
task_completed on the approval step of Invoice Approval sends the decision field and the approver to your finance system.
Invoice approval templateClose the ticket when the incident is resolved
checklist_completed on Incident Management lets your service desk close the matching ticket, with the checklist link in the note.
Incident management templateOpen a ticket when IT work is assigned
task_assigned on IT Onboarding creates a ticket in your service desk for each person given a step, one delivery per person.
IT onboarding templateKeep a supplier list in sync
The three data_set.record events tell your ERP when someone adds, changes or removes a supplier in CheckFlow during vendor onboarding.
Vendor onboarding template
If the system you want already has a Zapier app, Zapier uses these same events and saves you hosting a receiver.
Good to know
What webhooks don’t do
- 01
Some changes raise no event
Marking a task not applicable, un-completing a task and upgrading a checklist to a new template version send nothing. Bulk record creation and CSV imports into a Data Set don’t raise the record events either.
- 02
Delivery is at least once, in no fixed order
A retry can arrive after a later event, and a timeout means a delivery may come twice. Use the timestamps in the payload and deduplicate on CF-Delivery-Id.
- 03
A switched-off webhook only shows on the tab
After ten failed events in a row nobody is emailed. Check the Webhooks tab, or have your integration read its subscription now and then.
- 04
Events while paused are never sent
Pausing skips the webhook when its events fire. Nothing is queued for later, so pause only when missing those events is acceptable.
- 05
Only public https addresses
Localhost, private network addresses and URLs with a username or password are refused. Put any token your endpoint needs in the path or query instead.
Webhooks are included in the Business plan at $10 per user per month, or $9 billed annually, and in the free trial.
Ask an assistant why a webhook isn’t arriving.
Through the MCP server an assistant can read your webhooks and their delivery history, and replay a delivery, with the permissions of the key it holds.
Webhooks over MCP
Claude, ChatGPT, Gemini, Grok, Copilot or any other AI assistant can list webhooks, read deliveries, replay one and switch a webhook back on. The signing secret is never passed through the conversation.
AI in CheckFlowA template worth integrating
Describe the process and the free AI checklist generator drafts the template your webhook will watch.
Try the AI generatorManage them in code
The Webhooks API creates, pauses and deletes subscriptions, rotates secrets and reads deliveries.
Developer overview
Why isn’t our task_completed webhook reaching the accounts system?
webhookId: "task_completed · Invoice Review" outcome: "failed"
The last three deliveries each failed five times with 401 Unauthorized, so your endpoint is rejecting them. That often means it still checks the old signing secret. Once it is fixed, I can replay the three failed deliveries.
Templates teams connect with webhooks.
Each one has a step or a finish your other systems care about.
Related integrations
Webhook questions
What webhook events does CheckFlow send?
Nine: new_checklist, checklist_completed, task_completed, task_assigned, comment_created, file_uploaded, and data_set.record.created, updated and deleted. Most can be narrowed to one template, task or upload field; the three Data Set events always cover the whole workspace.
Can I send a webhook when a checklist is submitted or completed?
Yes. Subscribe to checklist_completed, for one template or the whole workspace, and CheckFlow posts the whole checklist when it becomes complete: every task with its fields and comments, the template and who started it. To act on one step instead, such as an approval, use task_completed scoped to that task.
How do I set up a webhook without code?
An Administrator opens the Webhooks tab of Team Management, clicks Add webhook, chooses the event, what it covers and the https address, then copies the signing secret, which is shown only once. Something still has to receive the POST: your own system, or a service that accepts webhooks.
How do I know a webhook really came from CheckFlow?
Check the CF-Signature header. It holds a timestamp and an HMAC-SHA256 of the timestamp and the raw body, keyed with your signing secret. Compute the same value and compare it in constant time, and refuse a timestamp more than a few minutes old. The docs include code for Node.js, Python and C#.
What happens if our endpoint is down?
A failed delivery is tried again, five attempts in all over a few hours, each with the same CF-Delivery-Id. If ten events fail in a row the webhook is switched off. The delivery history is kept for 30 days, so once your endpoint is back you can turn the webhook on and replay what it missed.
Do webhooks include field values?
Yes. new_checklist and checklist_completed send the whole checklist, with every task and its fields and comments. task_completed sends the task’s fields as they stand, with its assignees, comments, tags, checklist and template. The other events send a smaller record; the exact shapes are in the webhook events reference.
Should I use webhooks or Zapier?
Use Zapier if the app you want is already on Zapier: there is nothing to host. Use webhooks for your own systems, for anything Zapier doesn’t reach, or when you want signed deliveries and a replayable history. Zaps use webhooks underneath, so both appear on the Webhooks tab.
Which plans include webhooks?
Webhooks, the REST API and the MCP server are included in the Business plan at $10 per user per month, or $9 billed annually, and in the free trial. See pricing.
Send your first webhook today.
Start a free trial, add a webhook on the Webhooks tab and watch the first delivery arrive.
14-day free trial, no credit cardFull refund in your first 30 daysUS or EU hosting