Send to (webhook / n8n)

“Send to” pushes one document to a configured endpoint (a generic webhook or an n8n/Zapier/Make trigger). It is the document-based counterpart to folder shares: where a folder share lets a site pull a whole folder, “Send to” pushes a single document outward to drive an automation.

An endpoint is just a URL + an HMAC signing secret + a label. It has no scope — you choose per document what to send.
Manual: from a document’s menu → “Send to…” → pick an endpoint.
Auto on publish: opt a document in, and it is sent every time it is published.

Roles

Configuring endpoints (Settings → Send-to endpoints) requires the publishing.manage capability (Admin by default).
Sending a document (manual or enabling auto) requires the document.send capability (Admins + Editors by default) and read access to that document.

1. Create an endpoint

Settings → Send-to endpoints → New endpoint. Give it a label and the destination URL (e.g. your n8n webhook node URL).
Optionally paste your own signing secret (≥16 chars); otherwise one is generated. The secret is shown once — store it in your automation tool to verify signatures.

The URL is SSRF-validated (no internal/loopback/metadata hosts; HTTPS in production).

2. Send a document

From a document’s context/kebab menu choose “Send to…”, pick the endpoint, and confirm. The confirmation can be suppressed per user (“Don’t ask again”). Sending is queued — it does not block the UI; retries with backoff happen automatically, and an endpoint that keeps failing is auto-paused.

Auto on publish

In the same dialog, toggle “Auto on publish” for an endpoint. From then on, the document is sent every time it is published (re-publish included).

Payload & signature

Each delivery is a POST with a JSON body:

{
  "event": "document.send",        // or "document.published" for auto-on-publish
  "delivery_id": "<uuid>",         // stable id for receiver-side dedup
  "trigger": "manual",             // or "auto_publish"
  "timestamp": "<iso8601>",
  "document": {
    "id", "title", "emoji", "slug",
    "collection_id", "collection_name", "collection_slug",
    "published_at", "updated_at",
    "markdown": "<serialized body>"
  }
}

Headers:

Header	Meaning
`X-Orimora-Signature`	`t=<unix>,v=<hex>` — HMAC-SHA256 of `<t>.<rawBody>` with the endpoint secret
`X-Orimora-Event`	the event name
`X-Orimora-Delivery-Id`	same as `delivery_id` (dedup)
`X-Orimora-Timestamp`	the signed unix timestamp

Verify by recomputing HMAC_SHA256(secret, "<t>.<rawBody>") and comparing (timing-safe) to the v= part. Reject if the timestamp is too old to stop replay.