Toggl Webhook Setup Guide

Connect the account with a Toggl API token that can access the workspace you want events from. StackOne subscribes the account’s default workspace.

On connect, StackOne creates one webhook subscription on the default workspace with a wildcard filter covering every entity and action, then triggers Toggl’s PING validation and echoes the validation code automatically so the subscription becomes validated and enabled. Toggl enforces tight per-workspace limits (the Free plan allows 1 webhook and 3 event filters), so StackOne uses a single wildcard subscription to stay within the cap. Only the events you enable in StackOne are dispatched.

Fired for clients.

• Client Created (client.created) — Fired when a client is created in the workspace.
• Client Updated (client.updated) — Fired when a client is updated.
• Client Deleted (client.deleted) — Fired when a client is deleted.

Fired for projects.

• Project Created (project.created) — Fired when a project is created.
• Project Updated (project.updated) — Fired when a project is updated.
• Project Deleted (project.deleted) — Fired when a project is deleted.

Fired for project groups.

• Project Group Created (project_group.created) — Fired when a project group is created.
• Project Group Updated (project_group.updated) — Fired when a project group is updated.
• Project Group Deleted (project_group.deleted) — Fired when a project group is deleted.

Fired for project memberships.

• Project User Created (project_user.created) — Fired when a user is added to a project.
• Project User Updated (project_user.updated) — Fired when a project membership is updated.
• Project User Deleted (project_user.deleted) — Fired when a user is removed from a project.

Fired for tags.

• Tag Created (tag.created) — Fired when a tag is created.
• Tag Updated (tag.updated) — Fired when a tag is updated.
• Tag Deleted (tag.deleted) — Fired when a tag is deleted.

Fired for tasks.

• Task Created (task.created) — Fired when a task is created.
• Task Updated (task.updated) — Fired when a task is updated.
• Task Deleted (task.deleted) — Fired when a task is deleted.

Fired for time entries.

• Time Entry Created (time_entry.created) — Fired when a time entry is created.
• Time Entry Updated (time_entry.updated) — Fired when a time entry is updated.
• Time Entry Deleted (time_entry.deleted) — Fired when a time entry is deleted.

Fired for timesheets.

• Timesheet Created (timesheet.created) — Fired when a timesheet is created.
• Timesheet Updated (timesheet.updated) — Fired when a timesheet is updated.
• Timesheet Deleted (timesheet.deleted) — Fired when a timesheet is deleted.

Fired for workspace memberships.

• Workspace User Created (workspace_user.created) — Fired when a user is added to the workspace.
• Workspace User Updated (workspace_user.updated) — Fired when a workspace membership is updated.
• Workspace User Deleted (workspace_user.deleted) — Fired when a user is removed from the workspace.

Fired for the workspace itself.

• Workspace Updated (workspace.updated) — Fired when workspace settings are updated.

Toggl sends each event as an HTTP POST with a JSON body containing metadata (with model set to the entity and action set to created, updated, or deleted), payload (the full entity object, whose id is used as the event id), and created_at. Toggl sends one event per request.

Toggl validates the callback URL by sending a PING containing a validation_code. StackOne echoes it automatically to validate the subscription — no action is needed from you.

Toggl signs each delivery with an HMAC of the payload using the subscription secret StackOne sets at creation. StackOne relies on the unguessable callback URL as the security gate.