Integrations
Webhooks
Send new messages to your other tools
A webhook posts each new message to a URL you choose, as signed JSON, a few seconds after it arrives. Use it with your own server, or with a “catch hook” trigger in Zapier, Make, or n8n to reach Slack, a CRM, or a spreadsheet. Failed sends are retried for a few minutes. Messages caught by the spam filter, and healthcare forms, are never sent.
This workspace has HIPAA forms. A webhook that gets their messages can send notifications only (no message content), or full messages to a destination an Admin has authorized: your own system, or a vendor your organization has a Business Associate Agreement with. Each authorization is recorded, and every full message sent is logged in the access log. Only Admins can set those webhooks up; anyone who can edit can pause or delete one.
For developers
Checking a request came from us
Each request has an X-Vocreo-Signature header like t=1730000000,v1=5f2c…: an HMAC-SHA256 of <t>.<raw body> using the webhook’s signing secret. Recompute it, compare, and reject requests older than five minutes. X-Vocreo-Delivery is unique per send, so you can ignore repeats.
import { createHmac, timingSafeEqual } from "node:crypto";
function verify(rawBody, header, secret) {
const { t, v1 } = Object.fromEntries(header.split(",").map((part) => part.split("=")));
const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
const fresh = Math.abs(Date.now() / 1000 - Number(t)) < 300;
return fresh && expected.length === v1?.length && timingSafeEqual(Buffer.from(expected), Buffer.from(v1));
}Example body
{
"event": "submission.created",
"deliveryId": "dlv_…",
"test": false,
"workspace": { "id": "ws_…", "name": "Bright Bakery" },
"form": { "id": "…", "name": "Contact us" },
"submission": {
"id": "…",
"createdAt": "2026-10-23T17:04:11.000Z",
"website": "https://brightbakery.com/contact",
"values": { "name": "Alex Example", "email": "alex@example.com", "message": "Hello!" },
"fields": [{ "id": "name", "label": "Name", "value": "Alex Example" }, …]
}
}