> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xpressbot.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhooks

> See every webhook automation in your channel, the requests each one received, and why any failed.

## What is this?

A **webhook** lets another system tell your workspace that something happened — a form was submitted, an order was placed, a payment came through — by sending a request to a URL. Each webhook belongs to an automation that starts with the [Receive Webhook](/workspace/automation/triggers/receive-webhook) trigger.

The **Webhooks** pages show all of them in one place: every webhook in your channel, the requests each one received, and the exact contents of each request. Webhooks created by an integration such as [Shopify](/workspace/integrations/shopify) appear here too, marked with the integration's name.

\[SCREENSHOT: webhooks-list — The Webhooks page listing each webhook with its last received time, received count, and failed count]

## What can I do here?

* See every webhook automation of the channel, with how many requests it received and how many failed
* Copy a webhook's URL to give to another system
* Read every request it received, newest first, and filter by outcome
* Open one request to see its full raw body and the reason it failed
* Jump to the automation behind a webhook to change what it does

## How to use it

### Open the Webhooks page

Go to **Integrations** and click **Webhook** ("Click to view webhooks"). You need an active channel and the automations permission.

### Create a webhook

1. On the Webhooks page, click **Create webhook**. You're taken to Automation with the **Receive Webhook** trigger already chosen.
2. Build the flow and activate it. See [Create a Workflow](/workspace/automation/create-a-workflow).
3. Come back to Webhooks and open the new webhook to copy its URL.

### Read the list

Each row shows the webhook's name, when it last received a request (or **Never**), and:

| Item                  | Meaning                                                           |
| --------------------- | ----------------------------------------------------------------- |
| **Integration name**  | Shown if an integration created and manages it                    |
| **Active / Inactive** | Whether the automation is switched on                             |
| **N received**        | Total requests received                                           |
| **N failed**          | Requests that couldn't be processed (shown only if there are any) |

The list shows 10 at a time. Click a row to open it.

### Open a webhook

The webhook page shows:

* **Received**, **Failed**, **Last received**, and **Signature** (**Signed** or **Not signed**)
* The **Webhook URL** with a copy button. Send `POST` requests with a JSON body to this URL.
* **Received requests** — newest first. Each shows the date, the fields in the body, its size, and its outcome.

Use the filters **All**, **Processed**, **Failed**, and **Duplicate** to narrow the list. Click **Open automation** to edit the flow.

\[SCREENSHOT: webhook-detail — A webhook's page with its URL, signature state, and the list of received requests]

| Outcome                 | Meaning                                                                  |
| ----------------------- | ------------------------------------------------------------------------ |
| **Processed**           | The request ran the automation                                           |
| **Failed**              | The request was received but couldn't be processed — the reason is shown |
| **Duplicate (ignored)** | The same event was already handled, so it wasn't run again               |

### Read one request

Click a request to see its **status**, when it was **received**, its **size**, and its **request ID**. If it failed, the reason appears in a red box. Below is the **raw data** — the body exactly as it was received. Click **Copy body** to copy it.

\[SCREENSHOT: webhook-request — A single received request with its status and raw JSON body]

## Protect a webhook with a signing secret

By default, anyone who has a webhook's URL can send data to it. To only accept requests you trust, turn on signature verification:

1. Open the automation and select the **Receive Webhook** start step.
2. Under **Signing secret (optional)**, enter a secret of at least 16 characters, or click **Generate**.
3. Click **Save secret**. Save the automation first if you haven't.

The card then shows "Signature verification is on." To turn it off, click **Remove**.

The sending system must compute an **HMAC-SHA256** of the raw request body using your secret, and send it in the `X-Webhook-Signature` header as `sha256=<hex>`. Requests without a valid signature are rejected.

Webhooks managed by an integration are signed for you — their card says "Signed and managed by the connected integration," and the secret can't be edited.

## Troubleshooting / Technical Notes

* **"No webhook automations yet."** Click **Create webhook**, or connect an [integration](/workspace/integrations/overview) that creates one for you.
* **Nothing was received.** Check the automation is **Active**, and that the other system posts JSON to the exact URL shown.
* **Requests fail after turning on a secret.** The sender isn't signing correctly. Sign the raw body — exactly as sent, not reformatted — and include the `sha256=` prefix.
* **A request shows Failed.** Open it and read the reason. Missing data, such as no phone number for the contact, is a common cause.
* **The same request shows twice.** Providers retry. The repeat is marked **Duplicate (ignored)** and doesn't run the flow again.
* **"This webhook was not found."** The automation was deleted. Its requests are no longer available.

## Related docs

* [Receive Webhook trigger](/workspace/automation/triggers/receive-webhook)
* [Integrations Overview](/workspace/integrations/overview)
* [Manage Live Flows](/workspace/automation/manage-live-flows)
* [Create a Workflow](/workspace/automation/create-a-workflow)