Webhooks
Signed event deliveries from this project to HTTP endpoints you own.
Where: Project → Settings → Webhooks · /projects/<project>/settings?tab=Webhooks
Push event notifications from this project to HTTP endpoints you own. Every delivery is a signed JSON envelope POSTed to each destination subscribed to the event. The project has one webhook integration — a shared signing secret, shared extra headers, and any number of destinations. A badge shows whether it is Configured (the signing secret exists) or Not configured; you can define destinations either way, but deliveries only start once the secret is generated.
Screenshot TODO — capture comes from testing-plan area 17-project-settings.
Signing secret
One secret, shared by every destination on the project. Subscribers verify the X-Norbix-Signature header by computing HMAC-SHA256 of {timestamp}.{body} with this secret; the timestamp comes from the X-Norbix-Timestamp header.
Generate — provisions the secret the first time (turns the badge to Configured).
Reveal — shows the current secret so you can copy it into your subscriber.
Regenerate — after a confirmation: the current secret stops working immediately, and every subscriber must be updated with the new one.
Extra headers
Static headers added to every delivery from this project — for example an auth header your receiver expects. They are merged with each destination's own headers; the destination's header wins on conflict. Press Save Headers to apply.
Destinations
The endpoints that receive events. Each row shows the name, URL, subscribed events, an Enabled toggle (pause without deleting) and a Change link. Add Destination opens the same form:
Display name
How the destination is listed, e.g. Billing service. Required.
Endpoint URL
Full http(s) URL that receives the POSTed envelope, e.g. https://example.com/hooks/norbix. Required and validated as a URL.
Subscribed events
Checkboxes grouped by module — only the selected events are delivered. Database: database.record.inserted, database.record.updated, database.record.deleted, database.record.replaced, database.record.responsibilityChanged, database.records.inserted, database.records.updated, database.records.deleted. Membership: membership.user.registered, membership.user.invited, membership.user.verified, membership.user.updated, membership.user.deleted, membership.user.blocked, membership.user.reactivated. Files: files.file.uploaded, files.file.deleted.
Extra headers
Headers sent only to this destination, on top of the integration-wide ones (destination wins on conflict).
Enabled
Turn the destination on or off without deleting it.
In edit mode the form also has a red Delete… button; after the confirmation, deliveries to that endpoint stop immediately.
Example
A destination Billing service pointed at https://billing.example.com/hooks/norbix, subscribed to database.record.inserted and membership.user.registered: when a user registers, Norbix POSTs the signed envelope there, and your receiver recomputes the HMAC with the shared signing secret before trusting the payload.
API reference
Endpoints: Webhooks.
Last updated