Rule action: webhook

Updated

The webhook action sends a signed HTTP POST to your endpoint on each fire.

  1. Add a webhook action with the target URL.
  2. Optionally set a secret (used to sign the request) and custom headers — a JSON object such as {"X-Env": "prod"}.
  3. Save the rule.

A few header names are reserved and rejected when you save: Content-Type, Host, Content-Length, Connection, Transfer-Encoding and X-Synacl-Signature. Synacl sets those itself, and a custom X-Synacl-Signature would defeat the signature your endpoint relies on.

Each request includes an X-Synacl-Signature: sha256=… header — an HMAC-SHA256 of the body using your secret. Verify it on your side to confirm the request is genuinely from Synacl; see verifying webhook signatures. Your endpoint should return a 2xx quickly, and within 10 seconds — requests are not retried.

If a delivery fails you get an Action Failed event on your Events page carrying the reason (the status your endpoint returned, or a timeout), at most one per minute per rule and action type so a fast-firing rule cannot bury the log.