Many automations follow the pattern "When X occurs, Y follows". To achieve this, a system could keep asking whether something has changed. This so-called polling costs resources and responds with a delay. Webhooks reverse the principle: the source system reports on its own as soon as an event occurs. As a result, processes start in near real time and without unnecessary queries. Webhooks are therefore a basic building block of many integrations between cloud services.
How does a webhook work?
- The receiving system provides an endpoint, that is, an address reachable via HTTPS.
- In the source system, this address is registered for specific events, such as "order received".
- When the event occurs, the source system sends an HTTP request, usually via POST with the event data in JSON format.
- The receiving system confirms receipt with a status code and processes the data.
If the confirmation is not received, many systems retry the delivery later. The same message can therefore arrive more than once, which must be taken into account on the receiving side.
Typical examples
- A payment service reports a successful payment, and the online shop then releases the order.
- A contact form on the website transfers requests directly into the CRM.
- A monitoring alert appears as a message in a channel in Microsoft Teams.
- A change in the code repository automatically starts tests and deployment.
- A signature service reports a signed contract, which is then filed automatically.
What companies should keep in mind
- Verify the sender: many services sign webhooks with a shared secret. This signature should be verified, because a hard-to-guess address alone is no protection.
- Use only HTTPS and validate incoming data before processing.
- Respond quickly and offload elaborate processing to a queue to avoid timeouts.
- Handle duplicate deliveries and out-of-order events technically.
- Make failed deliveries visible via IT monitoring; otherwise, gaps go unnoticed.
How it differs
With a classic API query, a system actively fetches data. A webhook delivers it in an event-driven way. The two are often combined: the webhook reports that something has changed, and the details are then retrieved via the API. In process automation, webhooks are a typical trigger.
View automation