Rule action: webhook
The webhook action sends a signed HTTP POST to your endpoint on each fire.
- Add a webhook action with the target URL.
- Optionally set a secret (used to sign the request) and custom headers — a JSON
object such as
{"X-Env": "prod"}. - Save the rule.
A few header names are reserved and rejected when you save: Content-Type, Host,
Content-Length, Connection, Transfer-Encoding and X-Synacl-Signature. Synacl sets
those itself, and a custom X-Synacl-Signature would defeat the signature your endpoint
relies on.
Each request includes an X-Synacl-Signature: sha256=… header — an HMAC-SHA256 of the body using your secret. Verify it on your side to confirm the request is genuinely from Synacl; see verifying webhook signatures. Your endpoint should return a 2xx quickly, and within 10 seconds — requests are not retried.
If a delivery fails you get an Action Failed event on your Events page carrying the reason (the status your endpoint returned, or a timeout), at most one per minute per rule and action type so a fast-firing rule cannot bury the log.