Integration
Build your own Stride integration
Everything Stride’s own UI does, it does over a REST API you can call with a workspace key. Anything that happens in the delivery record can be pushed to your systems as an HMAC-signed webhook, with retries, replay, and zero-downtime secret rotation.
When you need this
The supported catalog covers source control, communication, migration, and coding agents. Everything else — an internal deployment tracker, a data warehouse, a compliance evidence store, a bespoke exec dashboard — is what the API and webhooks are for. Both are part of the product, not a partner programme: no application, no review, no separate contract.
The REST API: 80 endpoints across 15 areas
Authenticate with a bearer key and read or write the same objects the UI does. Every endpoint is permission-checked against the key creator’s role, and project-scoped objects are additionally gated per project — an API key never grants more reach than the person who created it.
| Area | Endpoints |
|---|---|
| Authentication | 7 — POST, GET, PATCH |
| Projects | 9 — GET, POST, PUT, DELETE |
| Dashboard | 1 — GET |
| Stories | 9 — GET, POST, PATCH, DELETE |
| Sprints | 5 — GET, POST, PATCH, DELETE |
| Epics & Labels | 4 — GET, POST |
| Architecture | 9 — GET, POST, PATCH, DELETE, PUT |
| Test Suites & Cases | 7 — GET, POST, PUT, DELETE |
| Test Runs | 4 — GET, POST, PUT |
| Defects | 5 — GET, POST, PATCH, DELETE |
| Processes | 6 — GET, POST, PUT, DELETE |
| Process Intelligence | 3 — GET, PUT |
| AI Execution | 2 — POST, GET |
| Artifacts & Activity | 3 — GET |
| Team & Settings | 6 — GET, POST, PATCH, DELETE |
The full reference, with request and response shapes for every endpoint, is in the product under Settings → API docs once you have a workspace.
Webhooks: 19 events you can actually receive
Subscribe an endpoint to any subset. Every event below has a real producer behind it — Stride does not list ids that never fire, because a ticked checkbox on a permanently silent endpoint is a worse outcome than a missing feature.
| Group | Event ids |
|---|---|
| Issues | story.created, story.status.changed, story.stage.changed, story.assigned, story.completed, story.deleted, story.mention, story.github.pr.linked, comment.created, comment.mention |
| Sprints | sprint.opened, sprint.closed, sprint.completed |
| Releases | release.created |
| Tests | test.run.completed |
| Defects | defect.created |
| Architecture | adr.created |
| Integrations | integration.error, webhook.disabled |
Verifying a delivery
Each request carries a signature header modelled on Stripe’s scheme, so reference implementations you already have will port with minimal change:
X-Stride-Signature: t=1755331200,v1=6f3a…c81b
signature = HMAC_SHA256(secret, timestamp + "." + rawBody)Sign the timestamp together with the body, not the body alone — that is what stops a captured payload being replayed later. During a secret rotation the header carries more than one v1= entry (current key first); a receiver holding a single secret should try it against each entry and accept on the first match.
Delivery guarantees
- Retries with exponential backoff — 1 min → 5 min → 30 min → 2 h → 12 h → 24 h. After the last attempt the delivery is marked dead rather than dropped.
- Manual replay — dead and failed deliveries stay visible and can be re-sent once your receiver is healthy.
- A 10-second timeout per attempt — return 2xx quickly and do your work asynchronously; a slow receiver reads as a failure.
- Zero-downtime secret rotation — a 24-hour dual-signing grace window, so you deploy the new secret on your own schedule.
Frequently asked questions
How do I authenticate against the Stride API?
With a workspace API key sent as a bearer token. Keys are created in Settings → API keys, carry the creator’s permissions, and are checked on every request — there is no separate public/secret pair to manage. Agent keys additionally carry an explicit project scope.
How are webhook payloads signed?
Every request carries an X-Stride-Signature header in the form t=<timestamp>,v1=<hex>, where the HMAC-SHA256 is computed over "<timestamp>.<body>" using your webhook secret. The scheme is modelled on Stripe’s, so existing reference code works. Verifying the timestamp as well as the body is what makes a captured payload non-replayable.
What happens when my endpoint is down?
Stride retries with exponential backoff — 1 min → 5 min → 30 min → 2 h → 12 h → 24 h — and marks the delivery dead after the last attempt. Dead deliveries stay in the Deliveries view and can be replayed by hand once your receiver is healthy, so an outage does not silently lose events.
Can I rotate a webhook secret without downtime?
Yes. Rotating parks the old secret for a 24-hour grace window, during which every delivery is signed with both keys and the header carries two v1= entries, newest first. Your receiver holds one secret and tries it against each entry, so you can deploy the new secret any time inside the window.
Which events can I subscribe to?
19 events across issues, sprints, releases, tests, defects, architecture decisions, AI generations, and integration health. The full list is on this page. Stride deliberately does not offer event ids that no producer fires — a subscribable event that never arrives is worse than an absent one.
Which plan includes the API and webhooks?
Every paid plan includes MCP access, the public API, and webhooks. Starter includes one API or agent key and one webhook; Pro and Enterprise increase those limits. See the pricing page for the full breakdown.
Prefer a ready-made connection? See the full integration catalog.