Webhooks

Send Fraym events to any HTTPS endpoint. Unlike a plain activity feed, Fraym can notify you when an idea reaches a strong signal, so you can act, not just log.

How it works

Add a destination under your workspace Integrations page. Choose the events you care about. When one fires, Fraym sends a signed JSON POST to your URL. Each delivery is signed with HMAC SHA-256 so you can verify it came from Fraym.

Events

Event	When it fires
idea.created	A visitor submitted a new idea (pending review).
idea.approved	A founder approved an idea, so it is now public.
idea.status_changed	An idea moved across the roadmap (planned, in progress, shipped).
idea.strong_signal	An approved idea reached a strong signal score. Sent once per idea.
changelog.published	A changelog post was published.

Headers

X-Fraym-Event: the event type.
X-Fraym-Signature: ts=<unix>;h1=<hex> HMAC signature.
X-Fraym-Delivery: a unique id for this delivery.
X-Fraym-Timestamp: the unix timestamp used in the signature.

Example payload

{
  "event": "idea.strong_signal",
  "id": "f1e2d3c4-...",
  "version": "1",
  "timestamp": "2026-06-18T12:00:00.000Z",
  "workspace": {
    "slug": "acme",
    "board_url": "https://fraym.dev/b/acme"
  },
  "data": {
    "idea": {
      "id": "9a8b7c6d-...",
      "title": "SSO and SAML login",
      "status": "under_review",
      "vote_count": 47,
      "comment_count": 2,
      "signal_score": 84
    }
  }
}

Verifying the signature

Compute the HMAC SHA-256 of `${timestamp}:${rawBody}` with your destination signing secret, then compare it to the h1value in the signature header. The secret is shown only once when you create the destination.

// Node. Recompute the HMAC and compare in constant time.
import crypto from "node:crypto";

function verify(rawBody, header, secret) {
  // header looks like: ts=1718712000;h1=<hex>
  const parts = Object.fromEntries(header.split(";").map((p) => p.split("=")));
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${parts.ts}:${rawBody}`)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(parts.h1)
  );
}

Delivery and retries

Deliveries are sent once. Fraym records the last status on each destination. Automatic retries are not available yet and are planned for a later release. Respond with a 2xx status quickly; long-running work should be queued on your side.

Slack decision alerts

Instead of a raw webhook, add a Slack destination to post clean, founder-style alerts to a channel. Slack is decision-first: it sends a strong-signal alert, a changelog-published alert, and optionally status changes. It does not post every new idea.

In Slack, add an app and enable Incoming Webhooks, then choose a channel.
Copy the webhook URL (it looks like https://hooks.slack.com/services/...).
In Fraym, open Integrations, choose Slack, paste the URL, pick your alerts.
Use Send test to confirm. The test message reads “Fraym Slack test alert”.

A strong-signal alert reads like: “Strong signal detected: SSO and SAML login just reached 84 signal with 47 votes. Heavy lift. Recommended move: scope a smaller first slice before committing.” The Slack webhook URL is stored securely and is never shown again after you add it.

Slack support is one-way for now: Fraym posts alerts. There is no Slack OAuth app and no bidirectional Slack commands yet.

Zapier and Make

There is no native Zapier or Make app yet. You can still connect Fraym to them using a generic webhook trigger (Webhooks by Zapier or a Make custom webhook) pointed at one of these destinations.

Questions? See support.