20+ LinkedIn event types.
Zero polling.
When something happens on LinkedIn, your systems hear about it: a message arrives, a connection request is accepted, an account needs attention. Curviate delivers HMAC-signed events to any HTTPS endpoint you register: your backend, an n8n flow, a serverless function.
How do Curviate webhooks work?
Register an endpoint URL, choose the events, and bind the webhook to the accounts it should watch; a webhook is always scoped to explicit accounts you own. From then on, each event is an HTTPS POST to your endpoint, signed with your webhook's secret. Verification is one function call. If your endpoint is down or returns a server error, delivery retries with exponential backoff. Every attempt is logged: the dashboard shows each webhook's health, its last delivery and a rolling success rate, so a silently failing endpoint has nowhere to hide.
Sensible defaults, deliberate opt-ins: the high-value events arrive out of the box, and the noisy or backfill-prone ones (chat updates, full connection sync, initial-sync progress) are subscribed explicitly, so your first webhook is quiet by default.
Every event type
All 24 events, grouped by source. Default means a new webhook for that source receives it without further configuration; Opt-in means you subscribe to it explicitly.
Messaging (8)
| Event | Fires when | Subscription |
|---|---|---|
| message.received | a new message arrives in a chat | Default |
| message.delivered | a message you sent reaches the recipient | Default |
| message.read | a message you sent is read | Default |
| message.reaction | someone reacts to a message | Default |
| message.edited | a message in a watched chat is edited | Default |
| message.deleted | a message in a watched chat is deleted | Default |
| chat.updated | a chat's metadata changes | Opt-in |
| chat.deleted | a chat is deleted | Opt-in |
Connections (2)
| Event | Fires when | Subscription |
|---|---|---|
| connection.accepted | a connection request you sent is accepted | Default |
| connection.new | a new first-degree connection is detected; sourced from periodic sync rather than real time, and the first subscription can deliver a backfill burst | Opt-in |
Account lifecycle (14)
| Event | Fires when | Subscription |
|---|---|---|
| account.created | a LinkedIn account is first linked | Default |
| account.connected | the account comes online | Default |
| account.synced | a sync cycle completes; catalogued but not currently delivered, read account state instead | NOT DELIVERED |
| account.reconnected | a reconnect succeeds | Default |
| account.reconnect_needed | credentials or cookies need refreshing | Default |
| account.creation_failed | linking an account fails; catalogued but not currently delivered, read account state instead | NOT DELIVERED |
| account.disconnected | the account is disconnected | Default |
| account.error | the account enters an error state | Default |
| account.paused | operations on the account are paused | Default |
| account.connecting | a connect attempt is in progress; catalogued but not currently delivered | NOT DELIVERED |
| account.permission_revoked | LinkedIn-side permissions are withdrawn; catalogued but not currently delivered, read account state instead | NOT DELIVERED |
| account.initial_sync.running | the first full sync starts | Opt-in |
| account.initial_sync.completed | the first full sync finishes | Opt-in |
| account.initial_sync.failed | the first full sync fails | Opt-in |
Four account events are catalogued and subscribable but not delivered by the current platform; account state reads cover the same ground. They are not counted toward the 20+ claim.
How do I verify a webhook signature?
Every delivery carries a Curviate-Signature header: a timestamp plus an HMAC-SHA256 of the raw body under your webhook's secret, with a five-minute replay tolerance. The SDK collapses verification, replay-window enforcement and parsing into one call:
import { constructEvent } from "@curviate/sdk"; const event = await constructEvent( rawBody, req.headers["curviate-signature"], process.env.CURVIATE_WEBHOOK_SECRET!, ); // event is typed; branch on event.event
Verifying by hand instead is a documented, standard HMAC comparison; the docs walk through it line by line.
Questions, answered
Yes. Curviate fires 20+ HMAC-signed event types covering messaging, connections and account lifecycle, delivered to any HTTPS endpoint you register and scoped to the LinkedIn accounts you choose. Failed deliveries retry with exponential backoff, and the dashboard logs every attempt.
Subscribe to connection.accepted. It is a default event: register a webhook for the connections source and the acceptance arrives as a signed POST with the account and connection identified in the payload. Delivery rides a periodic sync rather than a live push, so expect minutes to hours, not seconds.
Delivery retries on server errors with exponential backoff. Every attempt is recorded; the dashboard shows each webhook's health, its last delivery and a rolling success rate, so you spot a failing endpoint in days, not weeks.
Yes; a webhook is just a signed HTTPS POST, which every workflow tool ingests natively. Point the webhook at the tool's inbound-webhook trigger and branch on the event field. This is how LinkedIn events start automations in the rest of your stack today, ahead of the packaged integrations.
Webhooks are registered through the API or the dashboard; they are the outbound half of every integration. See also the actions catalogue and use cases.