Administrators define outbound HTTP calls on create, update, and delete for selected object types. Payloads and headers may be templated with a Jinja-compatible language. Optional HMAC signing protects receivers. SSL verification can be relaxed or pinned with custom trust stores when required (with operational caution).
A newer internal publish model emits structured change events and user events to pluggable brokers. Built-in adapters include syslog and Redis pub/sub; apps may register additional brokers. Event names follow predictable patterns based on app label and model. Payloads include before/after snapshots and a diff summary suitable for automation.
Future direction (per public docs): webhooks and hooks may eventually consume the same event stream for consistency.
Two layers coexist:
Changelog entries are readable in the UI and via read-only API and GraphQL surfaces; export formats exist for offline analysis.
Users may store named GraphQL queries for reuse—helpful for repeated reporting or integration prototypes.
Token-based access is standard; session authentication applies to browser use. Specific schemes and header formats are described in upstream operator documentation—not duplicated here.