Automations
Never the last
to know.
When a brand is released, a license is about to end, access changes or a proposal waits, the right inbox hears it, or Slack, Teams, n8n and your own tools. Every run is logged, and tried again if it fails.
Make one
Two questions.
Then it runs.
When does it start, and who hears it: a release, a license ending, a governance change, an asset refused again and again, something new in Fixes, a proposal left waiting. Or start from a recipe. A brand's editors make its release automations; admins make the rest.
New automation
When something happens in this project, tell someone.
What a webhook receives
{
"id": "6a1d0c4e-...",
"event": "brand.released",
"brand": { "slug": "artbucket", "name": "Artbucket" },
"release": 44,
"note": "The weekly accent",
"at": "2026-10-19T08:00:00.000Z",
"automation": { "name": "Tell the brand team" }
}
Abridged. A webhook POSTs this to an https address you give, signed with a secret shown once. An email goes to the addresses you list.
Send a test
Try it now.
Not on release day.
Send a test sends the real thing with a sample event, marked as a test. A delivery that fails is tried again 5 minutes later, then an hour after that, and every attempt is in the run log.
Automations
Let people, Slack, Teams or your other tools know when a brand is released, a license is about to end, or who may do what changes.
Run log
- Release 43: the weekly accentDelivered, Monday 08:00
- Release 42: the weekly accentDelivered, last Monday 08:00
Illustration of the app. The run log keeps an automation's latest 50 runs, each attempt with the webhook's status or the error.
Where it goes
Your inbox.
Or anything with a URL.
An email through your organization's own sending, or a webhook any tool can take: start an n8n or Make flow, rebuild a site, open a ticket. Or a message in Slack or Teams, one line with a link.
Signed webhooks
Trust the body.
Check the signature.
Every POST carries Artbucket-Signature, an HMAC of the body signed the way Stripe signs its webhooks. A retry sends the same id, so a receiver can tell it from a new event. Private network addresses are refused.
# or make it over the API curl -X POST https://your-artbucket/api/v1/automations \ -H "Authorization: Bearer $ARTBUCKET_KEY" \ -d '{"name":"Rebuild the docs", "trigger":"brand.released", "action":"webhook", "url":"https://ci.example.com/hooks/brand"}' # the answer holds "secret", once POST /api/v1/automations/{id}/test GET /api/v1/automations/{id}/runs
// check it before trusting the body
import { createHmac, timingSafeEqual } from "node:crypto";
function verify(body, header, secret) {
const { t, v1 } = Object.fromEntries(
header.split(",").map((p) => p.split("=")));
const expected = createHmac("sha256", secret)
.update(`${t}.${body}`).digest("hex");
const fresh = Math.abs(Date.now() / 1000 - t) < 300;
return fresh && v1?.length === expected.length
&& timingSafeEqual(Buffer.from(v1), Buffer.from(expected));
}
Around automations
They tell you.
Fixes shows what to do.
Hear it first.
Every time.
Free to start, on Cloud or on your own servers. Two questions, and the right people hear it first.