Webhooks and API access

If your division runs its own website or student system, CommunATI can send it events as they happen instead of someone re-typing results.

This is a developer feature. If nobody at your organization writes software, you do not need it.

Access tokens

Organization → Tokens creates an API token. The token is shown once, at creation. Copy it then; CommunATI never shows it again. If it is lost, revoke it and create another — that is faster and safer than hunting for it.

Give each system its own token. When one is compromised you revoke that one instead of breaking everything.

Webhooks

Organization → Webhooks points a URL at your system. CommunATI POSTs there when something happens — a result posted, a competitor registered, an event published.

Every delivery is signed. Your endpoint must verify the signature before trusting the body; an unverified endpoint will accept anything anyone sends it.

When a delivery fails

Failed deliveries are retried with a widening gap, and every attempt is listed with its response code. Test sends a sample immediately — use it before an event, not during one.

Rotating a secret

Rotate issues a new signing secret. The old one stops working the moment you rotate, so deploy the new secret to your system first, then rotate.