Custom Webhooks

Send a signed JSON payload to any endpoint on each submission. Use this to connect Formatrica to your own backend, a serverless function, or any service that accepts an HTTP POST.

Enable it

1. Open your form → Settings → Integrations.
2. Enable Webhook.
3. Enter the endpoint URL that will receive the POST.
4. Optionally enter a signing secret (recommended — see below).
5. Save the form.

Payload

Formatrica POSTs application/json with this shape:

{
  "form":    { "id": 12, "title": "Contact" },
  "submission": { "your_field_name": "value", "...": "..." },
  "meta":    { "your_field_name": { "label": "…", "type": "…" } },
  "context": { "ip_address": "…", "user_agent": "…" },
  "integration": "webhook"
}

You can reshape the body with the formatrica_webhook_payload filter — see the Hooks & Filters reference.

Verifying the signature

When a signing secret is set, each request includes an X-Formatrica-Signature header: the HMAC-SHA256 of the exact JSON body, keyed with your secret, as a hex digest. Verify it on your endpoint before trusting the payload:

$expected = hash_hmac('sha256', $raw_request_body, $your_secret);
if (!hash_equals($expected, $_SERVER['HTTP_X_FORMATRICA_SIGNATURE'] ?? '')) {
    http_response_code(401);
    exit;
}

The secret is stored encrypted and never shown again after saving. Leave it blank to send unsigned requests (not recommended for public endpoints).

Security & delivery

• Endpoints are validated to block requests to internal/loopback addresses (SSRF protection), redirects are not followed, and the response is size-limited.
• The built-in webhook is dispatched synchronously on submission. A failed delivery fires the formatrica_webhook_failed action so you can alert or log.

Zapier & Make

Zapier and Make use the same idea through their own dedicated cards and run in the background queue:

• Zapier — no authentication (Zapier catch-hooks have no receive-side auth).
• Make — supports a signed API-key header. In Formatrica Pro, the Make card adds an x-make-apikey header from an encrypted API key.

For a fully authenticated, HMAC-signed webhook to your own service, use this Custom Webhook integration.

Test it

• Point the endpoint at a request inspector (e.g. a test bin) and submit the form.
• Confirm the JSON body arrives and, if a secret is set, that the X-Formatrica-Signature header validates.