Updated March 2026
A webhook fires every time someone submits a form. Instead of polling for new data, you register a URL and the form platform sends a POST request to it immediately after each submission.
In Sutrena, webhooks are built in. Create one via the API or MCP, link it to forms, and receive submission data as JSON at your endpoint. Each delivery includes the submission data, form ID, timestamp, and a unique delivery ID.
But how do you know the webhook is real? Anyone who finds your URL could send fake data. Sutrena signs every delivery with HMAC-SHA256. The X-Sutrena-Signature-256 header contains a hash of the body computed with your webhook secret. On your server, compute the same hash and compare. Match means authentic. No match means reject it.
Delivery is at-least-once. If your endpoint returns a non-2xx or times out, Sutrena retries with exponential backoff. So your handler should be idempotent -- processing the same delivery ID twice shouldn't create duplicate records.
Where do people send webhooks? Their own backend for custom processing. Slack incoming webhook URLs for instant notifications. Zapier or Make for connecting to other services. Serverless functions on Vercel, Netlify, or AWS Lambda.
Plan limits: Free gets 1 webhook, Builder gets 5, Pro gets 10, Scale is unlimited. Each webhook can be linked to multiple forms, so even 1 webhook can cover all your forms at a single endpoint.
# Create a webhook
curl -X POST https://sutrena.com/api/webhooks \
-H "Authorization: Bearer st_live_your_key" \
-H "Content-Type: application/json" \
-d '{
"url": "https://your-server.com/webhook",
"secret": "whsec_your_secret"
}'