Publish automatically to any site

Webhook events

Suiko calls your address at every change of state of a proposal. On the first three, the JSON carries the full content.

• proposition.deposeeThe machine filed a proposal, to review.
• proposition.approuveeA reviewer approved it: time to publish.
• proposition.publieeThe page is live (through a connector, or your API call).
• proposition.rejeteeThe proposal was rejected.
• proposition.correction_demandeeA reviewer asked for a correction; a new version will follow.
• proposition.conflitThe page changed on the site in the meantime; the proposal awaits a decision.
• proposition.echec_publicationA connector failed to publish.

The JSON sent

Same shape for every event; the content block is only present on filed, approved and published. The X-Suiko-Event header repeats the event name.

{
  "event": "proposition.approuvee",
  "proposal_id": "3f1c…",
  "version": 1,
  "status": "approuvee",
  "page_slug": "blog/japan-rail-pass",
  "page_url": "https://www.kankou.example/blog/japan-rail-pass",
  "page_title": "Japan Rail Pass : prix, fonctionnement et rentabilité",
  "content": {
    "title": "Japan Rail Pass : prix, fonctionnement et rentabilité",
    "html": "<h2>Prix du pass en 2026</h2><p>29 650 ¥ pour 7 jours…</p>",
    "meta_title": "Japan Rail Pass 2026 : prix et rentabilité | Kankou",
    "meta_description": "Prix, fonctionnement et rentabilité du Japan Rail Pass…",
    "faq": [{ "question": "Le pass est-il rentable pour 7 jours ?", "answer": "Dès un aller-retour Tokyo-Kyoto…" }]
  },
  "url": "https://app.getsuiko.com/updates/3f1c…",
  "at": "2026-10-31T09:12:00.000Z"
}

The signature

Every call carries the X-Suiko-Signature header: “sha256=” followed by the HMAC SHA-256 of the raw body, computed with the secret shown in Settings > API. Check it if your address is public; Make and n8n usually skip it. On failure, Suiko retries after 5 seconds, then 20 seconds.

// Node.js : vérifier X-Suiko-Signature avec le secret de Paramètres > API
import { createHmac, timingSafeEqual } from 'node:crypto';
const expected = 'sha256=' + createHmac('sha256', process.env.SUIKO_WEBHOOK_SECRET).update(rawBody).digest('hex');
const ok = timingSafeEqual(Buffer.from(expected), Buffer.from(req.headers['x-suiko-signature'] ?? ''));

The API

Base: https://app.getsuiko.com. Every call carries the Authorization: Bearer chk_… header. Responses are JSON.

• GET/api/mises-a-jour?statut=approuveeYour organisation’s proposals, filtered by state (several states separated by commas) and by date (depuis=…).
• GET/api/mises-a-jour/{id}One proposal with its content ready to publish, the same content block as the webhook.
• POST/api/mises-a-jour/{id}/publieeMarks an approved proposal as published, optionally with { "url": "…" } of the live page.

curl -H "Authorization: Bearer chk_…" \
  https://app.getsuiko.com/api/mises-a-jour?statut=approuvee

Keys

An API key is created in Settings > API by an administrator; it is shown once. It is valid for the whole organisation and revoked in one click. The webhook secret is in the same place.

Good to know

• The webhook requires an https address. A failed call is retried twice, then logged; the application never waits for your server.
• The HTML in the content block is the one connectors publish: headings, paragraphs, lists, tables, FAQ, without layout.
• An approved page is deducted from your pack at approval, whether it is published by a connector, by your tool or by copying the text.
• Webflow, Shopify, Drupal, Prismic, a custom CMS: if you prefer a native connector, we build it on request, at no extra cost.