Connect other systems with API keys and webhooks

Updated October 30, 2026 · Applies to Stakeholder ONE 1.3

Connect Stakeholder ONE to your other systems:

  • API keys let another system call the Stakeholder ONE REST API, for example to sync accounts from your CRM.
  • Webhooks send a message to another system the moment a record changes, for example to post to a chat channel when a risk is added.

You manage both on the API & integrations page: select your avatar, and then select API & integrations. Select API reference at the top of the page for the full, interactive API documentation.

Prerequisites

  • The System Administrator role, or a role with the Administer permission.
  • Your plan must include API keys and webhooks (Business or Enterprise). See Plans and features.

Create an API key

  1. On the API keys tab, select New API key.

  2. Enter the following information:

    Field Description
    Name What the key is for, for example "CRM sync".
    Scope Read-only (GET requests only), or Read & write. Choose read-only unless the system needs to make changes.
    Expires (optional) The date the key stops working. Leave blank for no expiry.

  3. Select Create.

  4. Copy the key, and store it somewhere safe, such as your organization's password manager.

Important

The key is shown only once. If you lose it, revoke it and create a new one.

The other system sends the key with each request, in an Authorization: Bearer <key> header or an X-API-Key: <key> header.

The list shows each key's status: Active, Expired or Revoked.

Revoke an API key

Revoke a key when it's no longer needed, or if it might have been exposed.

  1. Select Revoke on the key's row, and confirm.

Any system using the key stops working immediately.

Create a webhook

  1. On the Webhooks tab, select New webhook.
  2. Enter a Name, and the Payload URL that should receive the messages. Use an https:// address so messages are encrypted in transit.
  3. Under Events, select the changes to send, or select Select all.
  4. Select Create.

Stakeholder ONE sends an HTTP POST request with a JSON body to the payload URL each time a selected event happens.

Events

Records Events
Accounts account.created, account.updated, account.deleted, account.restored
Stakeholders stakeholder.created, stakeholder.updated, stakeholder.deleted, stakeholder.restored
Projects project.created, project.updated, project.deleted, project.restored
Risks risk.created, risk.updated, risk.deleted, risk.restored
Deliverables deliverable.created, deliverable.updated, deliverable.deleted, deliverable.restored
Timeline events timelineEvent.created, timelineEvent.updated, timelineEvent.deleted, timelineEvent.restored
Discussion comment.created
Files attachment.created

Message format

Each request has these headers:

Header Value
X-StakeholderOne-Event The event name, for example project.updated.
X-StakeholderOne-Signature t=<timestamp>,v1=<signature>, for checking that the message came from Stakeholder ONE.

The body looks like this:

{
  "id": "unique message ID",
  "event": "project.updated",
  "createdAt": "2026-10-30T14:05:00.000Z",
  "data": { }
}

The receiving system must respond within 8 seconds with an HTTP status in the 200 range.

Verify the signature

Each webhook has its own Signing secret, shown on its row. To confirm that a message is genuine, the receiving system:

  1. Reads t and v1 from the X-StakeholderOne-Signature header.
  2. Computes an HMAC-SHA256 of <t>.<raw request body>, using the signing secret as the key, and hex-encodes it.
  3. Accepts the message only if the result equals v1, and t is recent.

Test and monitor a webhook

  • Select Send test on a webhook's row to send a test message right away.
  • Select Deliveries to see recent messages, with the HTTP status and response time of each, or the error if delivery failed.

To change a webhook's URL or events, select Edit. To stop it, select Delete.

Next steps