Cornerstone Webhook Setup Guide

Webhook screens in Edge are permission-gated. Ask your portal administrator to confirm the following permissions are assigned to your role before you begin.

• Edge Endpoints - External — create and edit the external endpoints used with Webhooks.
• Edge Endpoints - View — view existing Edge endpoints.
• Edge Webhooks - View — view existing Edge webhooks.
• Edge Webhooks - Event Category - LMS - External — required for the Training events.
• Edge Webhooks - Event Category - Employee - External — required for the Employee events.
• Edge Webhooks - Event Category - Skills - External — required for the Skills Library, User Skills and User Ratings events.

The Native Webhook URL is generated once an account has been linked, and it is unique to that account. Cornerstone sends every event to this address, and StackOne uses it to match inbound events back to the right connection — so use the URL from this connection and do not share it between accounts.

• Open the linked account in StackOne.
• Copy the value from Native Webhook URL.

Sign in to your Cornerstone portal and go to Admin > Tools > Edge > Endpoints, then select Create Endpoint.

• Endpoint Name — enter a descriptive name, for example StackOne Webhooks.
• Endpoint URL — paste the Native Webhook URL you copied from StackOne.
• Content Encoding — select gzip from the dropdown.
• Cornerstone generates an x-api-key and a Security Token for this endpoint. They are unique per endpoint and are regenerated every time a new endpoint is created.

An endpoint must be verified before a webhook can use it. Select Create and Verify to create and verify in one step, or select Create and then use the Verify link on the Endpoint Management page.

• Verification sends a short request to the Endpoint URL to confirm a secure connection. StackOne answers it automatically.
• If verification fails, re-check that the Endpoint URL matches the Native Webhook URL exactly, then select Verify again.
• Editing an endpoint later clears its verified state — re-verify it, and note that any webhook assigned to it stops until it is reverified.

Go to Admin > Tools > Edge > Webhooks and select Create Webhook. A webhook covers one event category, so repeat this step for each category you need.

• Webhook Name — enter a descriptive name, for example StackOne Training Events.
• Event Category — select the category. Cornerstone documents Employee, Skills Library, Training, User Ratings, User Skills and Status; portals licensed for the recruiting or ecommerce modules also show those categories. Create one webhook per category you need.
• Events — select the events you want delivered from the list that appears. See Available webhook events below.
• Endpoint — select the endpoint you verified in the previous step. If it is missing from the list, return to the endpoint and verify it.
• Configure Filters (optional) — add up to four filters to include or exclude events based on fields in the payload.
• Configure Projections (optional) — restrict which fields are sent. Keep the identifier and timestamp fields, as StackOne reads them to label each event.
• Encryption Key — leave empty for the Training, Skills Library, User Skills, User Ratings, Recruiting and Ecommerce categories. Cornerstone requires an encryption key on any webhook that emits Employee events, and StackOne cannot read a PGP-encrypted payload, so Employee events cannot be delivered to StackOne today. See Delivery format.
• Select Create and Start to begin delivery immediately, or Create Only to create the webhook in a stopped state and start it later from the Status toggle on the Webhook Management page.

A running webhook sends a heartbeat every five minutes, so you can confirm the connection without waiting for real activity. On Admin > Tools > Edge > Webhooks, the Status toggle shows whether each webhook is running.

• On the first start, Cornerstone replays the events it has retained, so expect a backlog and higher latency until it clears.
• A webhook that moves to a Failed state does not restart itself — fix the cause, then restart it from the Status toggle.
• A webhook can only be edited while its Status toggle is set to Stopped.

Learner transcript activity, under the Training event category.

• Training Assigned (TrainingAssigned) — Fired when a training is assigned to a learner and becomes actionable on their transcript
• Training Registered (TrainingRegistered) — Fired when a learner registers for a training or session
• Training Started (TrainingStarted) — Fired when a learner starts a training
• Training Completed (TrainingCompleted) — Fired when a learner completes a training
• Training Withdrawn (TrainingWithdrawn) — Fired when a learner withdraws from a training
• Training Cancelled (TrainingCancelled) — Fired when a training registration or session is cancelled
• Training Removed (TrainingRemoved) — Fired when a training is removed from a transcript
• Training Restored (TrainingRestored) — Fired when a previously removed training is restored to a transcript
• Training Archived (TrainingArchived) — Fired when a transcript item is archived
• Training Unarchived (TrainingUnarchived) — Fired when an archived transcript item is returned to the active transcript
• Training Approved (TrainingApproved) — Fired when a training registration request is approved
• Training Denied (TrainingDenied) — Fired when a training registration request is denied
• Training Marked Exempt (TrainingExempt) — Fired when a training is marked exempt for a learner
• Training Exemption Requested (TrainingExemptionRequested) — Fired when a learner requests an exemption from a training
• Training Exemption Approved (TrainingExemptionApproved) — Fired when a training exemption request is approved
• Training Exemption Denied (TrainingExemptionDenied) — Fired when a training exemption request is denied

User record changes, under the Employee event category. Read the encryption note under Delivery format before enabling these.

• Employee Creation (EmployeeCreated) — Fired when a new user is created in the portal, carrying the new user’s core data, organisational units and custom fields
• Employee Updated (EmployeeUpdated) — Fired when an existing user record changes, carrying only the changed core data, organisational unit and custom field values

Changes to the skills library itself, under the Skills Library event category.

• Skill Upserted (SkillUpserted) — Fired when a skill is created or updated in the skills library
• Skill Id Sync (SkillIdSync) — Fired when a skill identifier mapping is synchronised
• Skill Deleted (SkillDeleted) — Fired when a skill is deleted from the skills library

Skills held by individual users, under the User Skills event category.

• User Skill Added (UserSkillAdded) — Fired when a skill is added to a user’s profile
• User Skill Removed (UserSkillRemoved) — Fired when a skill is removed from a user’s profile

Skill rating activity, under the User Ratings event category.

• User Rating Submitted (UserRatingSubmitted) — Fired when a skill rating is submitted for a user, carrying the score and who rated whom
• Rating Request Created (RatingRequestCreated) — Fired when a skill rating request is created

Candidate conversation activity, under the Recruiting event category. This category only appears on portals licensed for the recruiting modules that produce these events.

• Recruiting Message Sent (SendMessage) — Fired when a message is sent in a candidate conversation
• Recruiting Conversation Closed (CloseConversation) — Fired when a candidate conversation is closed

Learning purchase activity, under the Ecommerce event category. This category only appears on portals licensed for ecommerce.

• Pending Payment Created (PendingPaymentCreated) — Fired when a pending payment is created for a learning purchase
• Pending Payment Updated (PendingPaymentUpdated) — Fired when a pending payment is updated