Put ThreadMaster inside your own workflow

Events

Envelope

{
  "id": "0f2c6d5e-…",
  "type": "post.published",
  "api_version": "v1",
  "created_at": "2026-09-08T14:00:07Z",
  "data": {
    "id": 512, "platform": "x", "thread_id": 1234, "status": "posted",
    "permalink": "https://x.com/you/status/18…", "n_posts": 5, "posted_count": 5,
    "items": [{ "position": 0, "status": "posted", "tweet_id": "18…", "text": "…" }],
    "metrics": { "likes": 0, "impressions": 0, "updated_at": null }
  }
}

Verify the signature

Each request carries ThreadMaster-Timestamp and ThreadMaster-Signature: v1=…, an HMAC-SHA256 of <timestamp>.<raw body> with your endpoint secret. Reject anything older than five minutes. Respond with any 2xx within 10 seconds; anything else is retried with backoff (1m, 5m, 30m, 2h, 6h, 24h) and the endpoint is paused after 20 consecutive failures.

import hashlib, hmac, time

def verify(secret: str, headers, body: bytes, tolerance=300) -> bool:
    ts = headers["ThreadMaster-Timestamp"]
    if abs(time.time() - int(ts)) > tolerance:
        return False
    expected = "v1=" + hmac.new(secret.encode(), f"{ts}.".encode() + body,
                                hashlib.sha256).hexdigest()
    # Two values appear for 24h after a secret rotation.
    return any(hmac.compare_digest(sig.strip(), expected)
               for sig in headers["ThreadMaster-Signature"].split(","))

import { createHmac, timingSafeEqual } from "node:crypto";

export function verify(secret, headers, rawBody, tolerance = 300) {
  const ts = headers["threadmaster-timestamp"];
  if (Math.abs(Date.now() / 1000 - Number(ts)) > tolerance) return false;
  const expected = "v1=" + createHmac("sha256", secret)
    .update(`${ts}.`).update(rawBody).digest("hex");
  return headers["threadmaster-signature"].split(",").some((sig) => {
    const a = Buffer.from(sig.trim()), b = Buffer.from(expected);
    return a.length === b.length && timingSafeEqual(a, b);
  });
}

Errors

Every error is {"error": {"code", "message", "details"}}.

Rate limits

Zapier & Make

Make and n8n work today with the HTTP module and a Bearer key. A native Zapier app is on the roadmap; the webhook subscribe/unsubscribe endpoints and the since filters are already REST-hook and polling friendly.