Advanced

Export your data and use webhooks

⏱ 5 minUpdated 2026-10-22

Your data is yours. Download everything your organization has in RankRight as one zip, and have RankRight tell your other tools the moment a job finishes, a report is filed or an item changes. No polling needed.

Sign in → API docs
  • JSON + CSV, every table
  • Signed HMAC-SHA256 events
  • Automatic retries

Part 1: Export your data

A complete, portable copy of your organization, ready for backups, audits, migrations or your own analysis.

1 Run an export ~2 min

  1. Open Account and scroll to Data export.
  2. Click Export organization data. The button changes to Export in progress… while it runs, and only one export runs at a time.
  3. After a few minutes the file appears in the table with its size, created date and Expires date. Click the file name to download the zip.

Have a webhook subscribed to job.completed? It fires when the export is ready, so your backup script can fetch the file automatically.

What's in the zip

  • Every table as JSON and CSV in data/: clients, services, locations, settings, pages, keywords and rank history, Search Console snapshots, SEO action items, AI Visibility questions, captures, tracker items and runs, jobs, members, API keys and webhooks.
  • Your filed reports (HTML, PDF and Word files) in reports/<client folder>/.
  • manifest.json with row counts per table and the exact columns that were left out.

Secrets never leave RankRight. Passwords, hashes, API key values, signing secrets and tokens are stripped from every table, along with the bulky raw AI-engine payloads. Exports are kept for 7 days.

Part 2: Webhooks

Instead of checking RankRight over and over, let it POST a signed JSON event to your server, Zapier, a CRM or an AI agent as soon as something happens.

2 Add a webhook ~2 min

  1. On the Account page, scroll to Webhooks.
  2. Enter your Endpoint URL (https) and an optional Description (e.g. "Zapier" or "our CRM").
  3. Under Events, leave all ticked, or tick only the events you need.
  4. Click Add webhook and copy the signing secret (it starts with whsec_). It's shown once.

Lost the secret? Click Rotate secret. The old one stops working immediately, so update your endpoint straight away.

Events you can subscribe to

EventFires when
job.completedA background job finished successfully, such as an export, scan or AI Visibility run.
job.failedA background job failed. The error is included.
job.cancelledA background job was cancelled.
aeo.capture.ingestedAn AI-engine answer was captured and analyzed for a client.
aeo.report.savedA client's monthly AI Visibility report was filed.
aeo.item.status_changedAn AI Visibility tracker item changed status.
action_item.status_changedAn SEO action item changed status.
api.deprecationAn API method or event is scheduled for removal (60 days' notice).
pingYou clicked Test.

Every delivery looks like this:

POST https://example.com/hooks/rankright
Content-Type: application/json
User-Agent: RankRight-Webhooks/1.0
X-RankRight-Event: job.completed
X-RankRight-Delivery: 1042
X-RankRight-Timestamp: 1792000000
X-RankRight-Signature: t=1792000000,v1=5f2b…c9e1

{"id": 1042, "event": "job.completed", "created_at": "2026-10-22 14:03:11",
 "org_id": 12, "client_id": 34,
 "data": {"job_id": 881, "kind": "export_org", "status": "done", "error": "",
          "result": {…}, "status_url": "/api/v1/jobs/881"}}

3 Verify the signature ~5 min

Anyone can POST to a public URL, so check that each request really came from RankRight. The X-RankRight-Signature header has the form t=<unix seconds>,v1=<hex>, where v1 is the HMAC-SHA256 of <t>.<raw body> using your signing secret. Here it is in Python:

import hashlib, hmac, time

def verify(secret: str, header: str, body: bytes, tolerance: int = 300) -> bool:
    """secret = your whsec_... value, header = the X-RankRight-Signature
    request header, body = the raw request body exactly as received."""
    try:
        parts = dict(p.split("=", 1) for p in header.split(","))
        t, given = int(parts["t"]), parts["v1"]
    except (KeyError, ValueError):
        return False
    if abs(time.time() - t) > tolerance:      # reject replays older than 5 min
        return False
    signed = f"{t}.".encode() + body           # "timestamp.body"
    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, given)

# Flask example:
# ok = verify(SECRET, request.headers.get("X-RankRight-Signature", ""), request.get_data())
# if not ok: return "", 401
  • Use the raw body bytes. Re-serializing parsed JSON changes the bytes and breaks the signature.
  • Reject timestamps more than 5 minutes old to block replayed requests.
  • Use the X-RankRight-Delivery id to ignore duplicates. Retries and redeliveries reuse it.

4 Test, monitor and redeliver ~1 min

  1. Click Test next to your webhook. A ping event shows up under Recent deliveries within a few seconds.
  2. Check the Status, Attempts and HTTP columns. Any 2xx within 10 seconds counts as delivered.
  3. Failed deliveries retry automatically with growing gaps for about two hours. Click Redeliver to send one again by hand.

After 100 failed attempts in a row, RankRight disables the webhook. Fix your endpoint, then click Enable. Delivery history is kept for 30 days.

Doing it from code

Everything above also works through the RankRight API with an owner-level key.

Exports

Start a job

POST /api/v1/jobs with {"kind": "export_org"}, then list files with the list_org_exports method.

Webhooks

Manage hooks

register_webhook, list_webhooks, test_webhook, rotate_webhook_secret and redeliver_webhook.

Easiest

Ask Claude

Connect Claude Code and just say "list my webhooks" or "show recent webhook deliveries that failed".

Full reference: API docs → Webhooks. To connect Claude, see Connect Claude Code to RankRight.

Questions

The short answers. The API docs have the details.

Who can export data or manage webhooks?
Only the organization owner. Both live on the Account page and need an active subscription. Integrations can also use the API with an owner-level key.
What's in the export zip?
Every table your organization owns as JSON and CSV (clients, pages, keywords and rank history, action items, AI Visibility questions, captures and tracker items, jobs, members, API keys and webhooks), plus your filed report files and a manifest.json that lists exactly what's included.
Is anything left out of the export?
Yes, on purpose: anything secret-shaped, such as passwords, password hashes, API key values, signing secrets and tokens, and the raw AI-engine answer payloads, which are large and reproducible from the scorecards. The manifest lists every column that was dropped.
How long can I download an export?
Export files are kept for 7 days, then deleted automatically. Run a new export any time you need a fresh copy.
What counts as a successful webhook delivery?
Any 2xx response within 10 seconds. RankRight doesn't follow redirects, so point the webhook at the final URL. Anything else is retried with growing gaps for about two hours (8 attempts in total).
Why did my webhook get disabled?
After 100 failed delivery attempts in a row, RankRight disables the webhook so it stops hammering a broken endpoint. Fix the endpoint, then click Enable on the Account page. Use Redeliver to resend anything you missed.
Can I send webhooks to an internal server?
Webhook URLs must be https and reachable from the public internet. Addresses that resolve to private, loopback or link-local networks are refused when you add the webhook.

Keep going

Guides that pair well with this one.

5 min

Connect Claude Code to RankRight

Connect Claude Code to your RankRight data in five minutes. Mint an API key, run one command, then ask about your clients in plain English.

Read the guide → 15 min

Single sign-on with Google, Microsoft or Okta

Let your team sign in with your company identity provider. Set up OpenID Connect or SAML 2.0 for Google Workspace, Microsoft Entra ID, Okta and others.

Read the guide → 5 min

Invite your team and choose roles

Invite teammates with a link, choose the right role (owner, SEO editor, web builder or viewer), manage access and turn on two-factor sign-in.

Read the guide →
Was this guide helpful?