Send new responses to your app

1. Step 1

   Open your form

   Go to Integrations and select the Webhooks tab.

2. Step 2

   Add the endpoint

   Select Add endpoint, then enter a name and the public HTTPS address that will receive responses.

3. Step 3

   Copy the signing secret

   Copy the secret shown after saving and store it securely with your application secrets.

4. Step 4

   Confirm delivery

   Select Send a test and open View activity. A successful response means your endpoint is ready.

Request headers

Reuily-Event

What happened.

Reuily-Delivery

The unique delivery ID.

Reuily-Timestamp

When the request was signed.

Reuily-Signature

The signature to verify.

1import { createHmac, timingSafeEqual } from "node:crypto";2 3const secret = process.env.REUILY_WEBHOOK_SECRET;4 5export function verifyWebhook(rawBody, timestamp, signature) {6  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;7 8  const match = /^v1=([a-f0-9]{64})$/.exec(signature);9  if (!match) return false;10 11  const expected = createHmac("sha256", secret)12    .update(timestamp + ".")13    .update(rawBody)14    .digest();15  const received = Buffer.from(match[1], "hex");16 17  return timingSafeEqual(received, expected);18}

1import hashlib2import hmac3import os4import time5 6secret = os.environ["REUILY_WEBHOOK_SECRET"].encode()7 8 9def verify_webhook(raw_body: bytes, timestamp: str, signature: str) -> bool:10    try:11        if abs(time.time() - int(timestamp)) > 300:12            return False13    except ValueError:14        return False15 16    if not signature.startswith("v1="):17        return False18 19    expected = hmac.new(20        secret,21        timestamp.encode() + b"." + raw_body,22        hashlib.sha256,23    ).hexdigest()24    return hmac.compare_digest(signature.removeprefix("v1="), expected)

Reuily does not follow redirects. Other 3xx and 4xx responses stop delivery until you fix the endpoint.

• Save Reuily-Delivery before starting the work created by the event.
• Skip the event when your app has already processed that delivery ID.
• Expect responses submitted close together to arrive in a different order.
• Use the event and submission timestamps when order matters to your workflow.

• Check whether a response was delivered, is retrying, or needs your attention.
• Read the safe failure explanation to understand what to check at your destination.
• After making a fix, select Send a test to confirm the endpoint works.
• After a longer outage, open the three dot menu and select Add previous responses.

Understand delivery errors

Use the status code to choose the first thing to check at your destination.

401 / 403

The destination rejected authentication or access. Check its credentials and permissions.

404

The webhook address was not found. Check the endpoint URL.

429

The destination is rate-limiting requests. Check its request limits.

408 or no response

The destination timed out or could not be reached. Check that it is online and publicly reachable, and accept or queue events promptly.

409 / 425

The destination could not accept the event yet. Check its availability and event handling.

5xx

The destination encountered a server error. Check its service status or server logs.

3xx

The destination returned a redirect. Use the final HTTPS endpoint URL; Reuily does not follow redirects.

Other 4xx

The destination rejected the request. Check its expected payload and endpoint configuration.