Payload

Each delivery is a JSON object with an event id, a type of mention or review, and the matched item.

{
  "id": "...",
  "type": "mention",
  "url": "https://app.mentiontone.com/threads/...",
  "mention": {
    "id": "...",
    "matched_terms": ["acme"],
    "excerpt": "...",
    "sentiment": "positive",
    "created_at": "2025-06-01T12:00:00Z"
  },
  "alert": { "id": "...", "name": "Acme" },
  "item": {
    "external_id": "t3_abc123",
    "permalink": "https://www.reddit.com/r/...",
    "body": "...",
    "posted_at": "2025-06-01T11:58:00Z",
    "platform": { "technical_name": "reddit", "clear_name": "Reddit" },
    "author": { "handle": "...", "followers_count": 120, "tags": [] },
    "category": { "name": "r/apple" },
    "translation": {
      "source_language": "de",
      "source_language_name": "German",
      "translated_body": "...",
      "translated_title": null,
      "status": "translated"
    }
  }
}

A review event carries review and review_alert objects in place of mention and alert, plus the review's title, country and language.

item.body and item.title are always the original text. item.translation is null unless the item's source language differs from your team's translation language; status is pending, translated or failed.

Request signing

Every request includes an X-Mentiontone-Signature header — an HMAC-SHA256 of the raw request body, keyed with your workspace signing secret. Verify it on arrival to reject spoofed requests.

# Ruby / Rails
expected = OpenSSL::HMAC.hexdigest("SHA256", signing_secret, request.raw_post)
ActiveSupport::SecurityUtils.secure_compare(
  "sha256=#{expected}",
  request.headers["X-Mentiontone-Signature"]
)

Find your signing secret at Team settings → Webhook → Request signing. Rotating it invalidates all prior signatures at once.

Retries and delivery log

Your endpoint must return 2xx within 10 seconds. Failed deliveries are visible in the delivery log at Team settings → Webhook → Delivery log.