Webhooks
Webhook integration

ClickUp Webhooks: Send Task and Workspace Events to Sazabi

By Sazabi Team

Webhook facts checked on the platform’s docs on Nov 8, 2026.

ClickUp webhooks announce changes to tasks, lists, folders, spaces and goals. If you point them at Sazabi, every change becomes a log record that you can search by task ID, user or event name.

What ClickUp sends

When an event you subscribed to occurs, ClickUp sends a POST with the event details to the URL you registered. The Content-Type is always application/json. The body carries the webhook_id, the event name and the ID of the resource, such as task_id or list_id.

The docs group event names by object:

  • Task: taskCreated, taskUpdated, taskDeleted, taskPriorityUpdated, taskStatusUpdated, taskAssigneeUpdated, taskDueDateUpdated, taskTagUpdated, taskMoved and taskCommentPosted
  • List, folder and space: listCreated, folderUpdated, spaceDeleted and similar
  • Goals and targets: goalCreated and keyResultUpdated and similar

Most payloads include a history_items array that describes the change, with before and after values. ClickUp suggests webhook_id:history_item_id as an idempotency key.

Why send ClickUp webhooks to Sazabi

Task changes are often the human side of an incident. A status moves to blocked, an assignee changes, a comment lands on the ticket for the outage. Stored as log records, those events sit in the same project as the logs from the service in question, and you can read the two in order.

Sazabi's Webhook Events source keeps each payload under webhook.* attributes. Search for a task ID and you get the full trail of events for it. A path suffix such as /clickup is stored as webhook.path, so you can pick this source out of others.

Create the webhook with the API

ClickUp creates webhooks through the API. There is no settings page in the docs for it. Get your intake URL from the Webhook Events source in Sazabi and treat it as a secret. Then call Create Webhook with your Workspace ID:

curl -X POST https://api.clickup.com/api/v2/team/<workspace_id>/webhook \
  -H 'Authorization: <your ClickUp API token>' \
  -H 'Content-Type: application/json' \
  -d '{
    "endpoint": "<your intake URL>/clickup",
    "events": ["taskCreated", "taskStatusUpdated", "taskCommentPosted"]
  }'

Use "events": ["*"] to subscribe to everything. To limit the scope, add space_id, folder_id, list_id or task_id. Only one location per hierarchy level is allowed, and the most specific one applies. The response includes a health object and a secret, which is the key ClickUp uses to sign requests.

The docs point to smee.io and webhook.site for inspecting requests rather than describing a test button, so the quickest check is to change a task in the subscribed location and look for the record in Sazabi.

Example ClickUp payload

This abbreviated example follows the taskStatusUpdated shape in the ClickUp docs. The values are illustrative.

{
  "event": "taskStatusUpdated",
  "task_id": "1vj37mc",
  "webhook_id": "7fa3ec74-69a8-4530-a251-8a13730bd204",
  "history_items": [
    {
      "id": "2800763136717140857",
      "field": "status",
      "date": "1642734631523",
      "user": { "id": 183, "username": "John" },
      "before": { "status": "to do" },
      "after": { "status": "in progress" }
    }
  ]
}

What to watch for

ClickUp monitors each webhook and gives it a health status.

  • Failing. A non-2xx response, or a request that takes longer than 7 seconds, marks it failing. ClickUp retries each event up to five times and then counts one failure in fail_count. Failed events are not resent after the endpoint recovers.
  • Suspended. At fail_count 100 the webhook is suspended and ClickUp stops sending. A 401 or 410 response suspends it at once. Reactivate it with PUT /api/v2/webhook/{webhook_id}.
  • Silent changes. The docs note that no notification is sent when health changes. Read the webhook object now and then, or watch for a drop in record volume.
  • Signing. The X-Signature header holds a hex HMAC-SHA256 of the body. The key is the webhook secret from the Create Webhook response.

Compare this with Zendesk and Pipedrive webhooks, which target support and sales workflows. More sources are on the integrations page, and plans are on pricing.

ClickUp webhook facts

Signatures: Sazabi doesn’t check ClickUp signatures by default, so it doesn’t reject unsigned or forged requests. Signature verification is in early access: contact support to turn it on for your organization, then verify signatures on the Webhook Events source with the Custom HMAC option (header X-Signature, SHA-256, hex), and Sazabi rejects a delivery that fails the check with a 401. Until it’s on, the intake URL is the only credential. It’s hard to guess, so keep it private, and rotate the project’s public key if it leaks.

  • Events: ClickUp lists task, list, folder, space, goal and target events, including taskCreated, taskUpdated, taskDeleted, taskStatusUpdated and taskCommentPosted. (ClickUp docs, accessed Nov 8, 2026)
  • Payload: Requests are sent with the POST method and a Content-Type of application/json, and the body includes webhook_id, the event name and the resource ID. (ClickUp docs, accessed Nov 8, 2026)
  • Signing: Every request is signed with HMAC using the webhook secret, and the hexadecimal signature is sent in the X-Signature header. (ClickUp docs, accessed Nov 8, 2026)
  • Retries: ClickUp retries a failing event up to five times, then increments fail_count, and suspends the webhook when fail_count reaches 100. (ClickUp docs, accessed Nov 8, 2026)

Frequently Asked Questions

Can I create a ClickUp webhook without writing code?

The ClickUp developer docs describe creating webhooks with the Create Webhook API endpoint. A single curl call with your Workspace ID, endpoint URL and events is enough.

How do I subscribe to every ClickUp event?

Use the * wildcard in the events array. You can also narrow a webhook to one Space, Folder, List or task with the matching ID.

What makes ClickUp suspend a webhook?

A 401 or 410 response suspends it immediately, and a fail_count of 100 suspends it too. You reactivate it by setting its status back to active with a PUT request.

Does Sazabi verify ClickUp signatures?

Not by default, and it doesn’t reject unsigned requests. Signature verification is in early access: contact support to turn it on for your organization, then turn on Verify signatures on the Webhook Events source with the Custom HMAC option (header X-Signature, SHA-256, hex), and Sazabi rejects a delivery that fails the check with a 401. Until it’s on, keep the intake URL private.

Sources

  1. Registering webhooks through the API, location filters, request criteria, example request and event names (accessed Nov 8, 2026)
  2. webhook.secret in the create response and the X-Signature header (accessed Nov 8, 2026)
  3. Active, failing and suspended statuses, 7 second timeout, five attempts, fail_count, 401 and 410 behavior (accessed Nov 8, 2026)
  4. Example taskCreated payload with history_items, task_id and webhook_id (accessed Nov 8, 2026)
  5. Create Webhook endpoint, endpoint and events body fields, wildcard for all events (accessed Nov 8, 2026)
  6. Webhook Events log source: JSON only, payload under webhook.* attributes, path suffix stored as webhook.path; signature verification with the Standard Webhooks and Custom HMAC options, and rejected deliveries (accessed Nov 8, 2026)