Webhooks

Receive platform events at your own HTTPS endpoint, signed so you can verify they're genuine.

A webhook delivers platform events to your own infrastructure. You register an HTTPS endpoint and pick the topics you care about; from then on, the platform POSTs each matching event to your URL as JSON, signed so you can prove it came from revenexx. This is how systems outside Revenue Cloud — an ERP, a data warehouse, a notification service — react to what happens on your tenant without polling the API.

If the reaction belongs inside the platform instead, handle the event from an App and skip webhooks entirely. Webhooks are for code you run yourself.

How it works

  1. You register an endpoint: an HTTPS URL plus the list of topics it should receive.
  2. The platform issues a signing secret for that endpoint, shown once at creation. Store it.
  3. When a subscribed event occurs, the platform POSTs the event envelope to your URL as a JSON body, with signature and metadata headers.
  4. Your endpoint verifies the signature, processes the event, and returns a 2xx. Anything else, or a timeout, counts as a failure and the platform retries.
A delivery
POST https://hooks.acme.example/revenexx
Content-Type: application/json
X-Revenexx-Id: evt_01jc8m4yq2…
X-Revenexx-Topic: order.created
X-Revenexx-Timestamp: 1748685600
X-Revenexx-Signature: v0=9f86d081884c7d659a2feaa0c55ad015a…

{ "tenant_id": "acme-eu", "topic": "order.created", "id": "evt_01jc8m4yq2…", "data": { … }, "metadata": {}, "time": "2026-05-31T10:00:00Z" }

Registering an endpoint

Endpoints are managed for your tenant through the customer console (Cockpit). You provide:

  • URL — an HTTPS endpoint you control. It must answer quickly with a 2xx.
  • Topics — which event types this endpoint receives. Subscribe to exactly what you need.
  • Custom headers (optional) — extra headers sent on every delivery, e.g. a routing tag. Reserved headers like Content-Type can't be overridden.

In return you get the endpoint's URL on file and a signing secret, shown once. Treat the secret like a password: store it where your receiver can read it, never commit it, and rotate it if it leaks.

The exact request and response shapes for managing endpoints and inspecting their delivery log are in the API Explorer. The concepts on this page — registering, choosing topics, delivery, and verification — are stable regardless of how you make the calls.

What's in this section

  • Delivery — retries, ordering, the delivery log, and what your endpoint must return.
  • Security — verify the signature on every delivery, with a code sample, and handle secret rotation.

Where to go next

  • Events — what the stream is and what an event looks like.
  • Event types — the topics you can subscribe to.
  • Integration Studio — turn an inbound event into a durable workflow against an external system.
Was this page helpful?