Trigger external workflows when LemonX actions happen inside WordPress.

Modern WordPress workflows should not wait for manual checking.

AI-powered websites generate many events: new drafts, content previews, SEO analysis, translation tasks, indexing requests, MCP actions, report generation, usage changes and license updates. Without webhooks, external systems must repeatedly ask WordPress if anything changed.

Webhooks reverse that flow. LemonX tells your system when something important happens.

Webhook events across the LemonX Suite.

LemonX Webhooks should follow the same product structure as the LemonX ecosystem. Each product can emit events related to its own workflows, while shared system events handle tasks, reports, licenses, usage and security.

Use headers to verify and process deliveries.

X-LemonX-Event: mcp.preview_applied
X-LemonX-Delivery: lx_delivery_123456
X-LemonX-Timestamp: 1783178400
X-LemonX-Signature: sha256=...
X-LemonX-Site: site_abc123
X-LemonX-Version: 1
User-Agent: LemonX-Webhooks/1.0

Example webhook signature verification.

The exact implementation may vary, but the general pattern is the same: combine timestamp and raw payload, generate an HMAC signature using the shared secret, then compare it to the signature header.

signed_payload = timestamp + "." + raw_body
expected_signature = HMAC_SHA256(webhook_secret, signed_payload)
compare expected_signature with X-LemonX-Signature

function verify_lemonx_webhook( $raw_body, $timestamp, $signature_header, $secret ) {
    if ( empty( $raw_body ) || empty( $timestamp ) || empty( $signature_header ) || empty( $secret ) ) {
        return false;
    }

    $tolerance = 300;
    if ( abs( time() - (int) $timestamp ) > $tolerance ) {
        return false;
    }

    $signed_payload = $timestamp . '.' . $raw_body;
    $expected = 'sha256=' . hash_hmac( 'sha256', $signed_payload, $secret );

    return hash_equals( $expected, $signature_header );
}

Webhook delivery should handle temporary failures.

Webhook endpoints can fail for many reasons: network issues, downtime, rate limits, deployment windows or temporary errors. LemonX should support retry behavior for failed deliveries.

Manage webhooks programmatically.

Developers can use REST API endpoints to register and manage webhooks. These endpoint names are examples and should match the final LemonX implementation.

GET    /wp-json/lemonx/v1/webhooks
POST   /wp-json/lemonx/v1/webhooks
GET    /wp-json/lemonx/v1/webhooks/{id}
PATCH  /wp-json/lemonx/v1/webhooks/{id}
DELETE /wp-json/lemonx/v1/webhooks/{id}
POST   /wp-json/lemonx/v1/webhooks/{id}/test
POST   /wp-json/lemonx/v1/webhooks/{id}/rotate-secret
GET    /wp-json/lemonx/v1/webhooks/{id}/deliveries
POST   /wp-json/lemonx/v1/webhooks/deliveries/{delivery_id}/resend

{
  "name": "Agency Dashboard",
  "url": "https://agency.example.com/lemonx/webhook",
  "events": [
    "content.updated",
    "aeo.analysis_completed",
    "verto.translation_completed",
    "mcp.preview_applied",
    "report.generated"
  ],
  "status": "active"
}

{
  "success": true,
  "data": {
    "id": "wh_123",
    "name": "Agency Dashboard",
    "url": "https://agency.example.com/lemonx/webhook",
    "status": "active",
    "events": [
      "content.updated",
      "aeo.analysis_completed",
      "verto.translation_completed",
      "mcp.preview_applied",
      "report.generated"
    ],
    "secret_preview": "whsec_****abcd"
  }
}

Subscribe only to events your system needs.

A busy WordPress site can produce many events. Developers should avoid sending every possible event to every endpoint. Instead, create focused webhook subscriptions.

Connect LemonX with Make, n8n, Zapier-style workflows and internal systems.

Webhooks make it possible to connect LemonX workflows with automation platforms. When a LemonX event occurs, the automation platform can receive the payload and trigger the next step.

Use webhooks to react. Use REST API to request.

Summary: REST API is request-based. Webhooks are event-based. Most serious integrations should use both.

Suggested event naming convention.

product.resource_action

content.draft_created
content.updated
aeo.analysis_completed
verto.translation_completed
mcp.preview_applied
report.generated
license.status_changed
usage.quota_warning
security.api_key_revoked

Send only the event data your integration needs.

Webhook payloads should include enough data to identify and process the event, but they should avoid sending unnecessary sensitive information.