Source · Hugging Face · Verified November 1, 2026

Hugging Face

Short answer: Hugging Face Hub webhooks report model and dataset repo changes, config updates, discussions, pull requests and comments.

Hooks verifies Hugging Face deliveries with shared secret sent verbatim in x-webhook-secret; the body is not signed, so a holder of the secret can modify it and normalizes them into the unified event format.

Start for free Source to target guides

Set up the webhook in Hugging Face

Open https://huggingface.co/settings/webhooks, create a webhook, and set its target URL to this Hooks receive URL.
Choose the model or dataset repos and the repo, repo.content, repo.config, discussion and discussion.comment scopes.
Configure an ASCII webhook secret and paste the same value here. Hugging Face sends it in X-Webhook-Secret; Hooks compares it in constant time.
Hugging Face signs no payload body: the shared secret proves the webhook configuration, not payload integrity. Only expose the HTTPS URL to trusted operators and rotate the secret if it leaks.
Retries and manual replays reuse Webhook-Id; deliveries can arrive out of order and each Webhook is limited to 1,000 triggers per 24 hours.

Signature verification

Header	`X-Webhook-Secret`
Algorithm	Shared secret sent verbatim in `X-Webhook-Secret`; the body is not signed, so a holder of the secret can modify it
Replay window	None; dedupe by delivery id
Delivery id	Webhook-Id

Events Hooks normalizes

event.type	subject	What it means
`discussion.create`	event	Hugging Face Hub webhooks report model and dataset repo changes, config updates, discussions, pull requests and comments.

Normalized payload

Every adapter produces this shape before filters or templates run. The raw payload and sanitized headers stay attached for audit, but filters and templates read the normalized fields.

Normalized event

{
  "id": "evt_demo",
  "source": "huggingface",
  "type": "discussion.create",
  "action": "create",
  "deliveryId": "delivery_demo",
  "subject": {
    "title": "Hugging Face event"
  },
  "raw": {
    "event": {
      "action": "create",
      "scope": "discussion"
    },
    "repo": {
      "type": "model",
      "name": "openai-community/gpt2",
      "id": "621ffdc036468d709f17434d",
      "private": false,
      "url": {
        "web": "https://huggingface.co/openai-community/gpt2",
        "api": "https://huggingface.co/api/models/openai-community/gpt2"
      },
      "owner": {
        "id": "628b753283ef59b5be89e937"
      }
    },
    "discussion": {
      "id": "6399f58518721fdd27fc9ca9",
      "title": "Update co2 emissions",
      "url": {
        "web": "https://huggingface.co/openai-community/gpt2/discussions/19",
        "api": "https://huggingface.co/api/models/openai-community/gpt2/discussions/19"
      },
      "status": "open",
      "author": {
        "id": "61d2f90c3c2083e1c08af22d"
      },
      "num": 19,
      "isPullRequest": true,
      "changes": {
        "base": "refs/heads/main"
      }
    },
    "comment": {
      "id": "6399f58518721fdd27fc9caa",
      "author": {
        "id": "61d2f90c3c2083e1c08af22d"
      },
      "content": "Add co2 emissions information to the model card",
      "hidden": false,
      "url": {
        "web": "https://huggingface.co/openai-community/gpt2/discussions/19#6399f58518721fdd27fc9caa"
      }
    },
    "webhook": {
      "id": "6390e855e30d9209411de93b",
      "version": 3
    }
  }
}

Filter and template examples

Filter

type equals "discussion.create"

Template

"Hugging Face event: {{event.subject.title}}"

Retries and the delivery log

408, 425, 429, and 5xx responses retry with backoff and honor Retry-After; other 4xx responses fail permanently with a named code. Every attempt keeps the rendered request and the target response, so a failure points at one field or one status instead of a guess.

Hooks delivery detail: attempt timeline, request payload, and the destination response for one delivery — Delivery detail: the attempt timeline, the rendered request the target received, and its response — the same record an event keeps for every destination.

Common errors

Symptom	Fix
`SIGNATURE_INVALID`	Use the signing secret Hugging Face shows when the webhook is created, and send X-Webhook-Secret for the exact raw body.
`Nothing arrives`	Confirm the webhook points at the endpoint's `/in/<endpoint-id>` URL and that the endpoint is active.

Pair with a target

All source to target guidesEvery combination built from this source, with filters and target configs.

Reference

Receiving eventshttps://huggingface.co/docs/hub/webhooks
Verify signatureshttps://hooks.events/docs/signatures.md
Payload templateshttps://hooks.events/docs/templates.md

Other sources

AirtableAirtable webhooks notify you when records in a watched table change; the changed records are fetched separately from the webhook payloads API.AsanaAsana webhooks cover task, project, section, story, team and goal changes, established by a one-time X-Hook-Secret handshake.Auth0Auth0 custom log streams POST tenant log events (login, signup, logout, token exchange, user changes) to a webhook.AWS SNSAWS SNS delivers JSON notifications and subscription confirmations to HTTP(S) endpoints, signed with an RSA certificate published under an sns.<region>.amazonaws.com URL.Azure DevOpsAzure DevOps service hooks send git pushes, pull requests, work items, builds and releases to a public webhook endpoint.BitbucketBitbucket Cloud repository webhooks cover pushes, pull request changes, and issue events.BrowserbaseBrowserbase Functions webhooks report invocation and build lifecycle states (pending, running, completed, failed).Cal.comCal.com booking webhooks wrap the booking in a triggerEvent envelope and sign each delivery with an HMAC-SHA256 of the raw body.Browse all sourcesSetup steps, signatures, events, and payload samples for every provider.