Attio Webhook Setup Guide

Authorize the connection using OAuth 2.0 or an API key that includes the webhook:read-write scope so StackOne can create and delete the webhook subscription on your behalf. No further setup is needed in Attio.

Enable the Attio events you want in StackOne. The provisioned webhook already covers every event type; StackOne dispatches only the events you have enabled.

Fired for records in any object (people, companies, or custom objects).

• Record Created (record.created) — Fired when a record is created.
• Record Updated (record.updated) — Fired when a record’s attribute values change (the changed attribute is named by id.attribute_id).
• Record Deleted (record.deleted) — Fired when a record is deleted.
• Record Merged (record.merged) — Fired when two records are merged.

Fired for lists.

• List Created (list.created) — Fired when a list is created.
• List Updated (list.updated) — Fired when a list’s configuration changes.
• List Deleted (list.deleted) — Fired when a list is deleted.

Fired when records are added to, changed in, or removed from a list.

• List Entry Created (list-entry.created) — Fired when a record is added to a list.
• List Entry Updated (list-entry.updated) — Fired when a list entry’s attribute values change.
• List Entry Deleted (list-entry.deleted) — Fired when a record is removed from a list.

Fired for notes.

• Note Created (note.created) — Fired when a note is created.
• Note Updated (note.updated) — Fired when a note’s metadata changes.
• Note Deleted (note.deleted) — Fired when a note is deleted.
• Note Content Updated (note-content.updated) — Fired when a note’s content is edited.

Fired for tasks.

• Task Created (task.created) — Fired when a task is created.
• Task Updated (task.updated) — Fired when a task is updated.
• Task Deleted (task.deleted) — Fired when a task is deleted.

Fired for comments and comment threads.

• Comment Created (comment.created) — Fired when a comment is created.
• Comment Resolved (comment.resolved) — Fired when a comment thread is resolved.
• Comment Unresolved (comment.unresolved) — Fired when a comment thread is unresolved.
• Comment Deleted (comment.deleted) — Fired when a comment is deleted.

Fired when the schema (attributes) of an object or list changes.

• Object Attribute Created (object-attribute.created) — Fired when an attribute is added to an object.
• Object Attribute Updated (object-attribute.updated) — Fired when an object’s attribute configuration changes.
• List Attribute Created (list-attribute.created) — Fired when an attribute is added to a list.
• List Attribute Updated (list-attribute.updated) — Fired when a list’s attribute configuration changes.

Fired for workspace membership and call recordings.

• Workspace Member Created (workspace-member.created) — Fired when a workspace member is added.
• Call Recording Created (call-recording.created) — Fired when a call recording is created.

Attio sends each event as an HTTP POST with a JSON body containing a top-level webhook_id and an events array. Each event object has event_type, an id object with the affected entity’s identifiers (for example record_id, note_id, task_id, entry_id, attribute_id), and an actor. Attio currently sends one event per request but may batch multiple events in the array in the future.

Update events carry identifiers only, not the changed values. For record.updated and the *-attribute.updated events, id.attribute_id tells you which attribute changed; fetch the record or attribute from the Attio API using the ids to read the new value.

Attio signs each delivery with an Attio-Signature (also X-Attio-Signature) header — an HMAC-SHA256 of the request body using the webhook secret. StackOne relies on the unique, unguessable callback URL as the security gate.